JWT Decoder

JWT header and payload segments are Base64URL-encoded, not encrypted. Anyone can create readable segments. Signature verification requires the expected algorithm and a trusted key obtained through a secure, application-specific process.

PayloadHarbor intentionally does not accept signing secrets, fetch remote JWKS documents, or label tokens as valid. Use your application's authentication library to verify a token before trusting its claims.

• iss identifies the issuer.
• sub identifies the token's subject.
• aud identifies intended recipients.
• iat, nbf, and exp are NumericDate values in Unix seconds.

Prefer synthetic or redacted tokens for debugging. Even with browser-local processing, tokens can be exposed through malicious extensions, clipboard managers, screen sharing, device compromise, or accidental logging elsewhere. Never treat a decoded payload as proof of identity or authorization.

Use this JWT decoder to inspect token headers, payload claims, Java record output, and verification snippets without sending the token to a server. It is intended for debugging and education, not for proving trust by itself.

• Decode JWT header and payload JSON while debugging authentication flows.
• Inspect registered claims such as iat, exp, nbf, iss, aud, and sub.
• Generate Java-friendly record shapes and JJWT verification examples for review.

JWT parsing happens locally in your browser tab. PayloadHarbor does not upload tokens.

Paste a JWT and decode it. The tool shows parsed header and payload JSON, claim timing status, Java record output, and verification snippet tabs.

• Decoding a JWT does not verify its signature or prove it is trustworthy.
• Avoid pasting live production tokens on devices or browsers you do not fully trust.