Decode a JWT

Decoding vs. verifying

A JWT's header and payload are just Base64URL-encoded JSON — anyone can decode them without a key, which is exactly what this tool does. Verifying the signature is a different operation entirely: it proves the token wasn't tampered with, and it requires the issuer's secret or public key, which this page never asks for or has access to. Don't treat a decoded-but-unverified token as trustworthy in your own code.

Common claims

• exp — expiration time (Unix timestamp)
• iat — issued-at time
• sub — subject, usually the user ID
• iss — issuer
• aud — intended audience