JWT decoder
Paste a JSON Web Token and read what is inside it. The decoding happens in this page, in your browser.
Your token
This page decodes the token and stops there. It does not check the signature, so it cannot tell you whether the service named in the token really issued it.
Registered claims
This runs in your browser. Nothing you paste or open is sent to us.
What the three parts hold
A JSON Web Token is three base64url parts joined with dots. The first is the header, which names the signing algorithm in alg and the token type in typ. The second is the payload, a JSON object of claims: iss for whoever issued the token, sub for whoever it is about, aud for whoever is meant to accept it, and iat, nbf and exp as seconds since 1970. The third is the signature, which is bytes rather than text and does not decode into anything readable. Only the registered claims get a row of their own here. Everything else the payload carries is in the payload block above, exactly as it was written.
Decoding is not verification
The header and the payload are encoded, not encrypted, so anybody holding a token can read them and this page does the same. What it cannot do is tell you the token is genuine. That takes the secret or the public key it was signed with, and it is the job of the service the token is presented to. Read what is below as a claim the token makes about itself. And treat a token you paste anywhere as a live credential until it expires, because it is still the thing that would let somebody act as the person it names.
Read the token, then see the request that carried it
Session Replay records the request that carried the token, the response it came back with and the console line beside it, so the next person to look at a rejected call already has the whole thing in front of them.