JWT inspection workflow
Decode a JWT and read its claims safely
Decoding a token shows its claims, but it does not confirm the signature is valid, which matters when you trust a token. Use the JWT decoder to inspect header, payload, and signature locally, with the JWT inspection guide as reference.
Read claims, then confirm trust separately
Use decoding for debugging. Confirm signature validity through the issuing service or backend library.
Paste the token
Use the full three-part JWT string.
Review the header
Check the algorithm and key identifier.
Review the payload
Check subject, issuer, audience, and expiry claims.
Confirm expected values
Compare claims against what the issuing service should produce.
What the three token parts contain
- Header: the signing algorithm and token type
- Payload: the claims such as sub, exp, and iss
- Signature: the part that proves the token was not tampered with
Decoding is not verification
Decoding shows the claims in plain text; it does not prove who signed the token. Verification requires checking the signature with the issuer public key.
Use the JWT decoder to inspect tokens during development, and the JWT expiry checker to validate the exp claim before a token is used.
What decoding cannot tell you
- A decoded token can still have an invalid signature
- Expired tokens can still be decoded successfully
- Claims can be spoofed in a token that was never verified
- Decoding alone does not confirm the issuer is trusted
Use decoded claims responsibly
- Never treat a decoded token as verified
- Check expiry before assuming a session is active
- Avoid pasting production tokens into shared devices
- Rotate a token immediately if it was shared by mistake
Frequently asked questions
Is decoding the same as verifying a JWT?
No. Decoding only base64-decodes the header and payload. Verification checks the signature with the issuer key.
Can anyone decode my JWT?
Yes. JWTs are not encrypted. Never put secrets in the payload; sign tokens only for integrity.
What does the exp claim mean?
exp is the expiration timestamp. Tokens past this time should be rejected by the server.
Does the decoder upload my token?
No. The token is decoded locally in your browser.
Decoding happens on the device
The token is decoded in the browser. Treat any pasted token as sensitive and rotate it if it was exposed elsewhere.
Open JWT Decoder