How to use JWT Decoder
A JSON Web Token usually contains a Base64URL-encoded header and payload plus a signature. Decoding exposes the readable claims for debugging, but it does not verify who created the token or whether its contents can be trusted.
XXF decodes locally so the token is not sent to an inspection service. Even so, avoid copying live credentials unnecessarily and revoke any secret accidentally shared elsewhere.
A reliable workflow
- Paste the complete three-part token
- Decode and inspect the algorithm, issuer, audience and time claims
- Verify the signature and claim rules in trusted server-side code before authorization
Worked example
Decode the included three-part demonstration token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTUxNjIzOTAyMn0.signatureThe header reports HS256 and the payload exposes sub, name and iat claims. The placeholder signature is displayed but not verified, so none of the claims should authorize access
When this tool helps
- Debug an expired access token
- Check issuer and audience mismatches
- Inspect custom claims during an authentication integration
Accuracy and safety notes
- Decoded claims are untrusted until signature verification succeeds
- Expiration, not-before, issuer and audience checks are separate from cryptographic verification
Frequently asked questions
Does XXF upload or store my data?+
No. The conversion runs locally in your browser. Your input is not sent to XXF, stored on a server or used for training.
Does decoding verify the JWT signature?+
No. Decoding only displays Base64URL data. Always verify the signature and claims with a trusted server-side library before granting access.