JWT Decoder

Decode and inspect JSON Web Tokens. View header, payload, and signature. Check expiration, issuer, and claims. 100% client-side.

Features

• Header, payload, and signature decoding
• Algorithm (alg) detection
• Expiration (exp) and issued-at (iat) checks
• Issuer (iss), subject (sub), and audience (aud) inspection
• Base64url decoding with syntax highlighting
• 100% client-side

Frequently Asked Questions

What is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe token format (RFC 7519) used for authentication and information exchange. It has three Base64url-encoded parts separated by dots: the header (algorithm and type), the payload (claims), and the signature. Despite being Base64-encoded, a JWT is NOT encrypted; anyone who reads it can decode the payload.

Is it safe to paste a JWT here?

Decoding is 100% client-side; the token never leaves your browser. However, never paste a JWT that contains a secret you rely on for security in a context you do not control, and remember JWT payloads are readable by anyone who has the token. If your token grants access, treat it like a password.

Does decoding a JWT verify its signature?

No. Decoding only reads the header and payload. Signature verification requires the secret (HS256) or public key (RS256/ES256) and a separate verification step. This tool focuses on inspection and debugging.

What are common JWT claims?

Standard registered claims include iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (unique JWT ID). Custom application-specific claims can also appear in the payload.