JWT Decoder & Claim Inspector
Inspect a token’s claims and expiry while debugging a request. The signature is not verified.
Paste a token to inspect its claims. The signature is displayed but not verified.
Debug the claim, then verify the token
A readable payload can help explain a failed request. It cannot tell you whether the sender was allowed to create that payload. Treat every decoded value as untrusted until your application verifies it.
| Claim | Question to ask |
|---|---|
exp / nbf | Has the token expired, or is its allowed start time still in the future? |
iss / aud | Does the issuer match your configuration, and is this API an intended audience? |
sub | Does this identify the user or service you expected? |
alg | This is a header value, not a claim of safety. Compare it with the algorithms your application explicitly permits. |
What can this decoder open?
Three dot-separated segments with Base64URL-encoded JSON in the header and payload. The signature segment is shown, not verified. Encrypted five-part JWE tokens are outside this tool's scope.
Keep tokens out of screenshots and support tickets — this page decodes locally, but copied token text may still grant access elsewhere. Prefer a redacted development example when discussing a problem.