JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe value commonly used to carry signed claims between an issuer and an application. A typical token has three dot-separated parts: a header, a Base64URL-encoded payload, and a signature. The header describes the algorithm and token type; the payload contains claims such as issuer, audience, subject, and expiry. Decoding reveals the representation, but it does not prove that the claims are authentic or current.

Paste a token only when you understand its sensitivity, and prefer a redacted or short-lived token for troubleshooting. Inspect the algorithm, issuer, audience, expiry, and not-before claims before relying on a value. A decoded payload is untrusted input: it may be expired, incorrectly scoped, or deliberately crafted. Signature verification must happen in the receiving service with the expected key, issuer, audience, and algorithm allow-list; decoding alone is never authorization.

JWTs often contain identifiers, email addresses, feature flags, or internal authorization context. Decoding in the browser avoids sending that material to a debugging service and makes the inspection step fast even when an API is unavailable. The privacy benefit has a boundary: browser JavaScript can display and, for supported HMAC algorithms, verify a signature, but it cannot replace server-side validation or protect a signing secret. Keep secrets out of the page entirely.