JWT Claims Decoder

About this tool

A JWT is three base64url blobs; the middle one holds the claims that drive your auth. This decoder shows the header and full payload in a readable table, translates registered claims (iss, sub, aud, exp, iat, nbf, jti…) into plain English, and converts timestamps into real dates.

The raw decoded JSON is included for copy-paste into tests or docs.

How to use it

1. Paste the JWT (Bearer prefix is fine).
2. Read the header table (algorithm, type) and the claims table.
3. Timestamps (exp, iat, nbf) are shown as both epoch and readable dates.
4. Copy the raw decoded JSON at the bottom if needed.

Useful ways to apply it

• Inspecting what your identity provider actually puts in tokens.
• Debugging authorization by checking scope/role claims.
• Documenting token structure for API consumers.
• Comparing tokens issued by different environments.

Worked example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE5MDAwMDAwMDB9.signature

{"sub":"123","exp":1900000000} — signature not verified

Edge cases to check

• JWT uses base64url, not ordinary base64.
• A readable payload can still be forged.
• Encrypted JWEs are different from three-part signed JWS tokens.

Known limitations

Decoding never verifies signature, issuer, audience, algorithm policy, revocation or authorization. Do not make access decisions from decoded claims alone.