JWT Decoder

Decode and inspect JWT tokens instantly. View the header, payload, and expiration date — all in your browser, never sent to a server.

What is a JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information as a JSON object. A JWT consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. JWTs are widely used for authentication and authorization in web applications and APIs.

JWT Structure

• Header — contains the token type (typ) and signing algorithm (alg), e.g. HS256 or RS256.
• Payload — contains claims: registered claims like sub (subject), iat (issued at), exp (expiration), plus any custom data.
• Signature — cryptographic signature used to verify the token. This tool does not verify it.

Common JWT Claims

• sub — Subject (user ID)
• iat — Issued At (Unix timestamp)
• exp — Expiration (Unix timestamp)
• iss — Issuer
• aud — Audience

Frequently Asked Questions

Is it safe to paste my JWT here?

Yes — this tool decodes JWTs entirely in your browser. Your token is never sent to any server. That said, avoid pasting production tokens containing sensitive data in shared environments.

Can this tool verify the JWT signature?

No. Verifying a JWT signature requires the secret key (HMAC) or public key (RSA/ECDSA). This tool only decodes the header and payload so you can inspect the claims.