What you see when you decode
A JWT has three Base64URL parts: header, payload, and signature. Decoding shows claims like exp, sub, and custom fields used by your API.
Decoding is not verification
Anyone can read an unsigned view of claims. Signature verification needs your secret or public key and belongs in your auth stack — not in a casual paste box on a shared machine.
Use the Korisa decoder
- Paste a token into JWT Decoder.
- Inspect header and payload JSON.
- Never paste live production secrets into tools you do not control end-to-end.