JWT decoder

How to use this decoder

Inspect a compact JSON Web Token while debugging an integration. The result separates its header and payload. Decoding alone cannot establish who issued the token or whether its contents are trustworthy.

1. Paste a three-part compact JWT, or use Try an example for a sample token.
2. Select Run utility to decode the header and payload.
3. Inspect the fields and time claims. Your application must independently verify the signature and validate the expected issuer, audience and expiry.

A small example

Decode JWT

eyJhbGciOiJub25lIn0.eyJzdWIiOiJkZW1vIn0.

{
  "header": {
    "alg": "none"
  },
  "payload": {
    "sub": "demo"
  },
  "signatureVerified": false
}

What to check before using the result

• The example is unsigned and for inspection only. A readable payload is not evidence of a valid login.
• Signature verification, key lookup and application-specific claim validation are not performed.
• Encrypted five-part tokens are not supported. This decoder expects JSON objects for the header and payload, with a maximum input size of 1 MB.

JWT claims and format reference: RFC 7519

Continue your task

• Unix timestamp converter — Convert an individual Unix timestamp to a readable date.
• JSON tidy — Format a copied JSON payload for inspection.