ToolBento guide
How to decode a JWT token and read its claims
Inspect a JSON Web Token header, payload, and expiry claim so you can debug authentication problems without verifying or changing the token.
Recommended tool
Open the matching ToolBento utility →First, know what decoding tells you
A JWT is usually three dot-separated parts: header, payload, and signature. Decoding reads the Base64URL-encoded header and payload so you can see fields such as alg, typ, sub, aud, iss, iat, and exp. It is useful for debugging, but it is not the same as proving the token is valid.
Use it for auth debugging, not trust decisions
When a login, API call, webhook, or mobile app request fails, decoding the token can quickly show whether the audience is wrong, the issuer is unexpected, or the expiry time has already passed. Treat the decoded text as a clue. A server still needs to verify the signature and enforce permissions before trusting any claim.
What to paste into ToolBento
Open ToolBento's JWT Decoder and paste the full token into the JWT token field. Include the dots between the parts, as in header.payload.signature. The tool can read a token with at least a header and payload, but a normal signed JWT will include all three parts.
Press Decode JWT and read the output
After pasting the token, press Decode JWT. The result shows a decode-only note, formatted Header JSON, formatted Payload JSON, and an Expiry status line when the payload contains a numeric exp claim. That makes it easier to copy a claim name into a bug report or compare the token with the API settings you expected.
Check exp, iat, iss, and aud first
For everyday troubleshooting, start with the time and identity claims. The exp claim is the expiration time in Unix seconds, while iat is when the token was issued. The iss value should match the system that created the token, and aud should match the API or application meant to receive it. A mismatch in any of these can explain a rejected request.
Do not paste production secrets casually
JWT payloads are only encoded, not encrypted, unless you are specifically using an encrypted token format. Anyone who can see the token may be able to read the claims, and bearer tokens can grant access until they expire. Avoid pasting live customer tokens, admin tokens, refresh tokens, or anything with sensitive claims into any public page.
Common mistakes when reading JWTs
Do not assume a decoded token is safe because it looks normal. Attackers can edit header and payload text unless the signature is checked by the receiving system. Also watch for time-zone confusion: exp is stored as a Unix timestamp, while the decoder output includes a local date and ISO date to help you compare it with logs.