Salesforce JWT Decoder
Paste a Salesforce JWT Bearer flow token to decode its issuer (connected app), subject (username), audience (org URL), and other claims. Verify the RS256 signature client-side.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
Understanding Salesforce JWT Bearer Tokens
Salesforce's JWT Bearer Flow is a server-to-server OAuth flow that does not require a user to interactively log in. The client application creates and signs a JWT assertion using a private key, sends it to Salesforce's token endpoint, and receives an access token in return. This flow is commonly used for integrations, scheduled jobs, and API-only clients.
In the JWT assertion, iss is the connected app's Consumer Key, sub is the Salesforce username of the user the app is acting on behalf of, and aud is the Salesforce login URL (https://login.salesforce.com for production or https://test.salesforce.com for sandboxes). The JWT must be signed with the private key whose corresponding certificate is uploaded to the connected app.
The Salesforce access token you receive after the flow is typically an opaque token — not a JWT — used in the Authorization header for API calls. However, you can request a JWT-formatted access token in certain Salesforce configurations. Paste a Salesforce JWT assertion above to inspect its claims and verify the RS256 signature.
Salesforce JWT Bearer claims
issIssuer — the connected app's Consumer Key.
e.g. 3MVG9d8...
subSubject — the Salesforce username being impersonated.
e.g. user@company.com
audAudience — the Salesforce login URL (or test URL for sandboxes).
e.g. https://login.salesforce.com
expExpiration — must be within 3 minutes of the request.
e.g. 1720000000
nbfNot before — the time before which the token is invalid.
e.g. 1719999700
jtiJWT ID — unique identifier, prevents token replay.
e.g. a1b2c3d4-...
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.