JWT decoder

About this tool

A JSON Web Token is three Base64Url-encoded segments separated by dots: a header describing the signing algorithm, a payload of claims, and a signature. The header and payload are only encoded, not encrypted, so anyone holding the token can read them. This tool decodes both instantly. The format is defined in RFC 7519.

Paste a token to inspect its claims: issuer (iss), subject (sub), audience (aud), expiry (exp), issued-at (iat), and whatever custom claims your provider adds. This is usually the fastest way to answer why an API rejected a token, which is often an expiry or audience mismatch, or to see what scopes a token actually carries.

Decoding runs entirely in your browser. The token is never transmitted, so it’s safe to paste production access tokens here. One thing this tool doesn’t do is verify the signature. To confirm a token is genuine, you still need to check it server-side against the issuer’s key.