JWT Claims Decoder
Decode a JWT's header and payload with every registered claim explained — locally, nothing uploaded.
Tokens are decoded locally in your browser and never leave your device. The signature is not verified.
Paste a JWT to decode its header and payload. Registered claims are explained in plain English.
Decoding happens locally. The signature is not verified and the token is never sent anywhere.
About this tool
A JWT is three base64url blobs; the middle one holds the claims that drive your auth. This decoder shows the header and full payload in a readable table, translates registered claims (iss, sub, aud, exp, iat, nbf, jti…) into plain English, and converts timestamps into real dates.
The raw decoded JSON is included for copy-paste into tests or docs.
How to use it
- Paste the JWT (Bearer prefix is fine).
- Read the header table (algorithm, type) and the claims table.
- Timestamps (exp, iat, nbf) are shown as both epoch and readable dates.
- Copy the raw decoded JSON at the bottom if needed.
Useful ways to apply it
- Inspecting what your identity provider actually puts in tokens.
- Debugging authorization by checking scope/role claims.
- Documenting token structure for API consumers.
- Comparing tokens issued by different environments.
Frequently asked questions
Can it verify the signature?
Are custom claims shown?
Why did decoding fail?
Privacy
Tokens are decoded locally in your browser and never leave your device. The signature is not verified.