Input
Output
Formatted result will be displayed here
JSON Web Tokens (RFC 7519) look like gibberish but are really three Base64-encoded segments: header, payload, and signature. A JWT Decoder unpacks the first two so you can see the claims — who issued the token, who it's for, when it expires, and any custom fields your app put in. EasyRead does this entirely client-side, so you can safely paste production tokens without sending them to a third party.
Grab the token your app just issued, paste it in, and confirm the claims, audience, and expiry look right.
EasyRead converts the exp timestamp to a readable local date so you know at a glance whether the token is still valid.
Paste tokens from Auth0, Okta, Cognito, Firebase, or Keycloak to understand exactly what each provider puts into the payload.
No. Verification requires the signing secret or public key and is something your backend should do. EasyRead only decodes the header and payload for inspection.
Decoding runs entirely in your browser — nothing is transmitted or logged. That said, treat a live JWT like a password: once it's on your clipboard, be mindful of where it ends up.
Header: algorithm and token type. Payload: claims about the user (sub, iat, exp, custom roles, etc.). Signature: an HMAC or RSA proof that the token wasn't tampered with.
They're Unix timestamps in seconds. EasyRead shows the human-readable date next to each. You can also cross-reference with the Timestamp Converter.
Yes for decoding — decoding is algorithm-independent. Verifying signatures (HS256/RS256/ES256) is a separate, secret-dependent operation.