Input
Output
Formatted result will be displayed here
Decoding a JWT means splitting it at the dots and Base64URL-decoding the middle part to reveal the claims that drive authorization decisions. In an auth debugging session you usually care about the subject, expiry, issuer, and audience: who the token says the user is, when it goes stale, and which backend it was minted for. This tool highlights those fields and flags common issues like an already-expired exp or a missing iss.
An auth failure is often a stale token; decode to check whether exp is in the past before chasing other causes.
A valid signature means little if iss or aud is wrong. Decode to confirm the token was minted for the service you are calling.
Roles live in claims like scope or role. Decoding surfaces them so you can tell why an authorized request was denied.
When rotating an identity provider, decoding each side reveals which claims changed and whether your backend tolerates the shift.
Yes. The payload is just Base64URL-encoded JSON, so reading it does not require the secret or public key.
The exp claim is shown next to a human-readable local time so you can see at a glance whether it is still valid.
iss is the token issuer, typically the auth server URL; aud is the intended audience, usually your API identifier.
Decoding happens entirely in your browser, but pasting live tokens is still a habit worth avoiding when screen sharing.