JWT Tools

JWT Decoder

The token is decoded as you type. Trust status is visually separated from readable claims so “decoded” is never presented as “verified”.

Encoded JWT3 compact parts

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJuYW1lIjoiQWxpY2UiLCJpYXQiOjE3MDAwMDAwMDAsImV4cCI6NDEwMjQ0NDgwMH0.8zjdl2v_p-FKzQ7pA2jR2Q0kY5HuKCsY8EbULYv_JhA

—Algorithm

—Type

—Expiry

—Claims

iss—

sub—

aud—

SignatureNot verified

Decoded locally · signature not verified

Readable claims are untrusted until cryptographic verification and application checks succeed.

Registered & common claims

Header & payload JSON

Header—

Payload / claims—

Claim timing & signature metadata

—Signature bytes

3Compact parts

—Activity

—Token bytes

Decode before you trust

The decoder separates algorithm/type, expiry/activity state, registered claims, raw header/payload JSON, and signature metadata so token structure is readable at a glance.

Verification boundary

Decoding is not signature verification. Validate the cryptographic signature with the intended key and algorithm, then enforce issuer, audience, time, nonce/replay, and application authorization policy separately.

Trust and standards boundaries

Formatting is not schema validation, Base64 is not encryption, URL normalization is not a privacy guarantee, UUID metadata is not provenance, and decoded JWT claims are not trusted until cryptographic and application-specific validation succeeds. RS256 tools accept explicit PEM key formats and do not fetch issuer keys or make authorization decisions.

How to use this JWT Decoder

Paste a compact JWT and compare the encoded token with separate header, payload, signature-size, and registered time-claim panels.