How to decode a JWT safely

Claims to review

• iss: the issuer that created the token.
• aud: the intended application or API audience.
• sub: the user or subject identifier.
• exp: the expiry timestamp.
• alg: the signing algorithm in the header.

Useful next tools

After decoding, use Unix Timestamp Converter for expiry values and JSON Beautifier for readable payloads.

Safety notes before decoding

A JWT decoder reads the token header and payload. It does not need the signing secret to show those parts. That also means anyone with the token can read non-encrypted claims, so sensitive personal data should not be placed in JWT payloads unless the design explicitly accounts for it.

Do not paste live access tokens from production systems into shared chats, tickets, or public tools. If you only need to inspect structure, replace unique identifiers and user data with sample values first.

The exp claim is usually a Unix timestamp. Convert it to a readable date to confirm whether the token should still be accepted. Also check aud and iss when debugging why an API rejects a token.

What decoding does not prove

Decoding shows readable claims, but it does not verify the signature. Signature verification requires the correct key or public key and must happen in the application or trusted backend logic.

Troubleshooting token issues

If a decoded JWT looks correct but an API rejects it, compare the audience, issuer, expiry, and clock time on the server. Also confirm whether the API expects a signed access token, an ID token, or a different environment. Similar-looking tokens can be valid for one service and invalid for another.

Example workflow

Start with a small representative sample instead of a full production file. Run the matching tool, inspect the result, and only then repeat the workflow with the complete content. This helps catch formatting, encoding, or data-shape problems while the input is still easy to review.

When the output looks correct, copy or download the result and keep a note of the source, date, and settings you used. For team workflows, link the relevant guide and tool together so another reviewer can reproduce the same check later.

Final review checklist

• Confirm the input is safe to handle in a browser and does not contain secrets.
• Run the tool with a small sample before processing a larger file.
• Review the output for structure, formatting, and unexpected changes.
• Use the related tools when the workflow needs validation, comparison, cleanup, or conversion.