JWT Decoder — How to Use and Inspect Claims
Use the OpenTrojan JWT Decoder to decode JWT header and payload locally, inspect claims, and stay safe — signature is never verified and no secret is needed.
Quick Answer
JWT Decoder reads the header and payload claims locally without verifying the signature; it is for inspection only and must not be used to accept or trust a token.
Definition
JWT Decoder decodes a JSON Web Token's header and payload claims locally to inspect them.
What it is
JWT Decoder (/tools/jwt/) decodes the header and payload of a JSON Web Token (three base64url segments) locally.
How to use
- Copy the JWT you want to inspect (the three dot-separated parts).
- Paste it into
/tools/jwt/. - Read the decoded header (
alg,typ) and payload claims (sub,exp,iss,aud, custom claims).
Interpretation
- Header
alg— what algorithm claims to sign it; notenoneor weak algorithms as danger signs. - Payload claims —
exp/iatfor validity window,iss/audfor intended issuer/audience, and any custom claims. - Decoding does not authenticate the token — anyone can decode; only the signature proves the issuer, and this tool does not verify signatures.
Limitations
- The signature is never verified, by design — the tool is for inspection, not validation.
- Claims can be misleading if you distrust the token; do not make authorization decisions from decoded bytes alone.
Privacy
Decoding is entirely in the browser — the token never leaves your machine, so it is not sent anywhere or stored.
Next steps
- Stay safe while decoding → Decode JWT safely.
- Put tokens in context → Application security hub.
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.