🔐 JWT Decoder

Paste a JSON Web Token to decode and inspect its header, payload, and expiry.

Paste JWT Token

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange. It consists of three parts separated by dots: Header (algorithm), Payload (claims/data), and Signature (verification). This tool decodes the header and payload - it does NOT verify the signature.

Have questions? Check our FAQ page.

Understanding JSON Web Tokens

JSON Web Tokens (JWT) are an industry standard for securely transmitting information between parties as a compact, URL-safe token. They're widely used for authentication in modern web applications, APIs, and mobile apps. A JWT consists of three base64-encoded parts separated by dots.

JWT Structure

Header - Contains the algorithm (e.g., HS256, RS256) and token type
Payload - Contains claims (data) like user ID, email, roles, and expiration time
Signature - Cryptographic signature to verify the token hasn't been tampered with

Common JWT Claims

sub - Subject (usually user ID)
iss - Issuer (who created the token)
exp - Expiration time (Unix timestamp)
iat - Issued at (when the token was created)
aud - Audience (intended recipient)

Important Security Note

This tool decodes the header and payload of a JWT - it does NOT verify the signature. Decoding a JWT does not require a secret key (the payload is just base64-encoded, not encrypted). Never store sensitive data in JWT payloads as they can be decoded by anyone.

Related Tools

🔢 Base64 Encode/Decode

Encode or decode Base64 strings.

✨ JSON Formatter

Format and validate JSON.

📗 JSON Schema

Generate JSON Schema from data.

TS JSON → TypeScript

Generate TypeScript interfaces.