Practical guide
How to use JWT Decoder
JWT Decoder reveals the readable header and payload inside a JSON Web Token. It helps developers inspect algorithms, subjects, issuers, audiences, and expiration claims without sending a token to a remote decoder.
Step by step
- Paste a three-part JWT into the token field.
- Select Decode token.
- Inspect the JSON header, payload, and any expiration message without treating the result as verified.
Example
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiI3NyJ9.signatureHeader algorithm: HS256; payload subject: 77How it works
JWT header and payload sections use Base64URL encoding. The tool decodes those two sections as UTF-8 JSON; it does not possess the signing key or validate the cryptographic signature.
Important limitations
- Decoded claims can be forged and must not be trusted without signature verification.
- Avoid pasting active production tokens on shared or untrusted devices.
Real workflows
When this tool is useful
Claim inspection
Read issuer, audience, subject, role, and expiry claims while debugging why an application accepts or rejects a session.
Environment checks
Compare tokens from staging and production to spot a wrong audience, tenant, scope, or authorization-server URL.
Support diagnostics
Explain the non-secret structure of a redacted sample without installing a command-line decoder or sending it to a third-party service.
Review the result
What to check before using the output
Treat every decoded field as untrusted text until the signature and application rules are verified. Also check expiry, not-before, issuer, audience, token type, and any server-side revocation policy.
- Decode is not verification.
- Check issuer and audience together.
- Review exp and nbf as UTC times.
- Revoke a token exposed outside a trusted device.
Choose the right method
When another tool is better
Use the authentication library in the target application for real verification because it has the expected algorithm, key set, issuer, and audience. A browser decoder cannot make an authorization decision.
Privacy and browser behavior
Decoding is local, but an active bearer token may grant access to an account. Prefer an expired or redacted token and never publish the full value in an issue, chat, or screenshot.
Frequently asked questions
Does a successful decode mean the token is valid?
No. Decoding only reveals claims. Your application must verify the signature, issuer, audience, expiry, and other rules.
Is the token uploaded?
The decoder runs in the current browser tab and does not send the token to a 77 Toolkit backend.