JWT Decoder

JWT (JSON Web Token) Decoder Online

JWT (JSON Web Token) is a widely used standard for authentication and authorization in modern web applications. This tool lets you decode and inspect the contents of a JWT token quickly and securely.

How to Use the JWT Decoder

Paste your JWT token into the text field
Automatically view the decoded header, payload, and signature
Check the token's status (valid or expired)
Inspect the claims and other token information

Structure of a JWT

A JWT is made up of three Base64-encoded parts separated by dots:

Header: Contains metadata about the token, such as the signing algorithm
Payload: Contains the claims about the user and other metadata
Signature: Ensures the token hasn't been tampered with

Common JWT Claims

iss (Issuer): Who issued the token
sub (Subject): The subject of the token (usually the user ID)
aud (Audience): Who the token is intended for
exp (Expiration): When the token expires
iat (Issued At): When the token was issued
nbf (Not Before): When the token becomes valid

Security and Best Practices

Important: This tool only decodes the JWT's contents. To fully validate a token in production, you should always verify its signature using the appropriate secret or public key.

Remember that a JWT's contents are only encoded (not encrypted), so never include sensitive information like passwords in a JWT's payload.

Common Use Cases

Debugging applications: Verify the correct data is in the token
Inspecting tokens: Understand the structure of third-party tokens
Checking expiration: Verify whether a token is still valid
Development: Test tokens while building APIs

Frequently Asked Questions About JWT

Everything you need to know about JWT tokens and our decoding tool

What is a JWT token?

JWT (JSON Web Token) is an open standard (RFC 7519) that defines a compact, self-contained way to transmit information between parties as a JSON object. It's widely used for authentication and authorization in web applications.

How does a JWT work?

A JWT is made up of three parts separated by dots: Header (algorithm and type), Payload (data/claims), and Signature. The format is: xxxxx.yyyyy.zzzzz

Is it safe to decode a JWT here?

Yes. This tool decodes tokens entirely in your browser — no data is ever sent to any server. Keep in mind, though, that it only decodes the token; it doesn't validate its signature.

Why does my JWT show as expired?

JWTs contain an "exp" (expiration time) claim indicating when the token expires. If the current date is past that timestamp, the token is considered expired and shouldn't be trusted.

What are claims in a JWT?

Claims are statements about an entity (usually the user) plus additional metadata. There are standard claims like "iss" (issuer), "exp" (expiration), "sub" (subject), and you can also add custom claims.

Can I verify the JWT signature with this tool?

No. This tool only decodes the JWT's contents. To verify the signature, you need the secret or public key (depending on the algorithm) and a dedicated library.