JWT Decoder
Decode a JSON Web Token locally to inspect its header and payload without transmitting the token to KBY or another server.
Run JWT Decoder
Inputs stay in this browser and results are not saved.
Prefer a redacted or non-production token. Decoded claims may still contain personal or privileged data.
{ // Protected header }{ // JWT claims set }Who this Lab is for
Designed for
- Application and API developers
- Identity engineers
- Security and platform teams
Use it when
- Checking issuer, audience, subject and expiry claims during authentication debugging
- Inspecting token structure without pasting a credential into a remote decoder
- Comparing the token a client received with the claims an API expects
A complete run, step by step
Remove unnecessary exposure
Use a non-production or redacted token whenever possible. A JWT can contain personal or privileged claims even when decoded locally.
Paste the compact token
Provide the three dot-separated JWT segments. The decoder processes them only in your browser.
Inspect header and payload
Check algorithm, key identifier, issuer, audience, subject, expiry and application-specific claims. Treat browser-clock time results as advisory.
Verify elsewhere
Decoding does not validate the signature. Use the receiving service or a trusted verification library with the correct key and policy.
What you will need
Prepare the following information before starting. Use measured evidence where possible; defaults are examples and should not be treated as recommendations.
What the result tells you
Your report includes
- Decoded JOSE header
- Decoded JWT claim set
- Strict Base64URL, UTF-8, JSON and duplicate-member checks
- Advisory expiry, not-before and registered-claim observations
How it is determined
Requires the three-part compact JWS form, enforces canonical unpadded Base64URL and valid UTF-8, and requires the protected header and claims set to be JSON objects without duplicate members. It inspects signature presence and registered claim types, and compares NumericDate claims with the browser clock. It deliberately does not send the token to a server or claim to verify its signature, key, issuer, audience or application policy.
Strict compact-JWS structure, canonical Base64URL, UTF-8 and JSON-object parsing are deterministic. Claim observations follow RFC 7519, but only the receiving system can verify cryptography and policy.
Model assumptions
- • Input is a compact signed or unsecured JWT using the standard 3-part JWS serialization; encrypted 5-part JWE tokens require decryption.
- • Validation of cryptographic signatures is not required for header and payload decoding.
- • The decoded claims are informational only; the tool does not enforce expiry or audience claims.
Authoritative references
Audience mismatch
Situation
An API returns 401 even though the identity provider issued a structurally valid access token.
Result
The decoded aud claim names a different API. The evidence points to client resource/scope configuration rather than token corruption.
Use the result with engineering judgement
- Decoding is not signature verification and does not prove the token is authentic.
- Displayed claims can contain sensitive data; avoid production credentials where possible.
- The tool does not decide whether issuer, audience, time or algorithm policy is acceptable to a particular service.
- Clock-skew allowances and required claims are verifier-specific; browser-clock observations are not an acceptance decision.
Questions before you begin
Does KBY receive the token?
No. Decoding runs in the browser and the token is not submitted to KBY.
Does a successfully decoded JWT mean it is valid?
No. Anyone can construct decodable segments. Authenticity requires cryptographic signature verification and policy checks.
Why does the tool report an invalid JWT format?
A compact signed JWT has three dot-separated segments. Confirm the complete token was copied without truncation or surrounding text.
Can this decode encrypted JWTs?
No. The utility decodes signed or unsecured compact JWT header and payload segments; encrypted JWE content requires decryption keys and a different workflow.
Ready to run JWT Decoder?
Open the interactive utility without an account. Inputs and results are not saved.
Open toolGet practical engineering references
One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.