How to decode a JWT token

Open JWT Decoder, paste the full token, and review the header and payload panels. The header usually shows the token type and algorithm. The payload contains claims such as subject, issuer, audience, role, issued-at time, and expiry time.

Decoding is not the same as verification. A browser decoder can show readable claims, but it does not prove the signature is trusted by your backend. Use it for debugging and inspection, then rely on server-side validation for access decisions.

JWT exp and iat values are Unix timestamps. If the decoded payload contains exp, use Timestamp Converter or JWT Expiry Checker to translate it into readable UTC and local dates. Many authentication bugs come from expired tokens, clock drift, or confusing seconds with milliseconds.

If the token is malformed, confirm it has three dot-separated segments. If a segment decodes to JSON, format it with JSON Formatter before sharing the example with a teammate.

Do not paste active production tokens into public tickets, screenshots, or chat messages. Decode locally, redact sensitive values, and share only the fields needed to explain the issue.