JWT Decoder
Decode and inspect a JSON Web Token — header, payload, and every claim, with human-readable expiry and timing. Useful for debugging OAuth 2.0 / OpenID Connect flows, Anypoint Flex Gateway JWT policies, and API auth headers.
🔑 The signature is shown for reference only. Decoding a JWT never verifies it — verification requires the issuer's secret or public key, which this tool intentionally never asks for.
What a JWT actually contains
A JSON Web Token is three Base64URL-encoded segments joined by dots:
header.payload.signature. The header names the signing
algorithm (alg) and token type; the payload carries the
claims; the signature is computed over the first two segments with a
secret or private key. Because the header and payload are only encoded — not
encrypted — anyone can read them. Never put secrets in a JWT payload.
Registered claims (RFC 7519): iss (issuer),
sub (subject), aud (audience), exp (expiry),
nbf (not before), iat (issued at), and jti
(token ID). Timing claims are Unix seconds — this tool converts them to your local
time and flags an expired or not-yet-valid token.