Paste a JSON Web Token to read its header and payload. Use this when debugging auth flows, expired claims, or mismatched audiences—without sending the token to a remote decoder you do not control.
About JWT Decoder
JWTs are three Base64url segments. The middle payload often holds subject, expiry, and role claims that explain why an API rejected a request.
This decoder focuses on inspection: it surfaces readable JSON so you can verify iss, aud, exp, and custom claims during local testing.
Treat tokens as secrets. Prefer staging tokens here, and avoid pasting production credentials into any online tool when policy forbids it.
How to Use JWT Decoder
- Paste the full JWT string (header.payload.signature).
- Run Decode.
- Review the header and payload JSON.
- Copy claims you need for tickets or tests.
If decode fails, check for truncated tokens, extra whitespace, or a non-JWT Bearer prefix.