JWT Decoder

A JSON Web Token is three Base64url segments separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. Read as a raw string it tells you nothing, which makes debugging an authentication failure frustrating when the answer is usually sitting in plain sight inside the payload.

Decoding reveals the claims: who the token identifies, which issuer produced it, which audience it is intended for, when it was issued and when it expires. In practice the expiry claim explains most mysterious 401 responses, and an audience or issuer mismatch explains most of the rest. Custom claims carrying roles and permissions explain the majority of unexpected 403s.

Decoding is not verification. Anyone can read a token's contents because the payload is merely encoded, not encrypted; only the signature proves the token was issued by who it claims and has not been altered, and verifying that requires the secret or public key on the server. Never trust claims from an unverified token in application logic, and be careful where you paste production tokens.

How to use the JWT Decoder

1. Copy the token from your request header, storage or log entry.
2. Paste it into the decoder.
3. Read the header to see the algorithm and key identifier.
4. Read the payload claims, checking issuer, audience, subject and expiry.
5. Convert the expiry timestamp to a readable date to see whether the token is still valid.

Examples

• A developer finds that an intermittently failing API call is using a token that expired minutes earlier.
• An integrator checks the audience claim after a partner service rejects an otherwise valid token.
• A support engineer confirms which role claims a user's token carries when a permission check fails.

Frequently asked questions

Does decoding verify the token?

No. Decoding only reveals the contents. Verification requires checking the signature with the appropriate key, which happens on the server.

Is the payload encrypted?

No, it is Base64url encoded and readable by anyone holding the token. Never put secrets in a JWT payload.

What do iat, exp and nbf mean?

Issued at, expiry, and not before. All are Unix timestamps in seconds, and all three are commonly checked during validation.

Is it safe to paste a production token here?

Decoding runs locally in your browser, but treat live tokens as credentials and prefer test tokens whenever you can.

SwiftMultiTool — free online tools for everyone. Home · Blog · About · FAQ · Contact