How to use JWT Decoder
- Paste the tokenPaste the complete JWT, including the dots between its segments, into the Token field.
- Decode itPress Run JWT Decoder to Base64URL-decode the first two segments.
- Read header and payloadCheck the pretty-printed Header and Payload, such as alg, kid, exp or custom claims. The signature segment is not checked.
Common uses
- Checking which claims and scopes an access token carries
- Reading exp and iat when an API rejects a token as expired
- Confirming the alg and kid in a token header while debugging auth
Frequently asked questions
How do I use JWT Decoder?
1. Paste the token: Paste the complete JWT, including the dots between its segments, into the Token field. 2. Decode it: Press Run JWT Decoder to Base64URL-decode the first two segments. 3. Read header and payload: Check the pretty-printed Header and Payload, such as alg, kid, exp or custom claims. The signature segment is not checked.
Does it verify the signature?
No. The tool only decodes the header and payload, and the result says so. The signature is never checked, so a decoded token is no proof that it is genuine or untampered.
Are exp and iat converted to dates?
Yes. When the payload has exp, iat or nbf claims, they are listed below it as UTC dates, and an exp in the past is highlighted. The payload itself shows the claims exactly as they are in the token.
Does it work with encrypted tokens?
Only signed tokens (JWS) have a readable payload. With an encrypted JWE token you can read the header, but the second segment is an encrypted key, not JSON claims.
Is it safe to paste a live token?
The token is sent to the GigaTools server, decoded there and returned; the tool does not store it. A valid token can still grant access, so prefer expired or test tokens over production ones.