JWT Decoder — Decode JWT Token Online

Paste any JSON Web Token to decode and inspect the header, payload, claims, and expiry. Runs entirely in your browser — your token is never sent to any server.

🔒 Privacy: Decoding is done entirely in your browser using JavaScript. Your JWT token never leaves your device.

JWT Token

TOKEN STRUCTURE

Header (algorithm & token type)

Payload (claims)

Signature

The signature is used to verify the token was not tampered with. It requires the secret key to validate — this tool decodes the token structure only, it does not verify the signature.

What Is a JWT Token?

A JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties. A JWT has three parts separated by dots: Header (algorithm and token type), Payload (claims — user ID, roles, expiry, etc.), and Signature (verifies the token hasn't been tampered with). JWTs are widely used for API authentication and single sign-on (SSO).

JWT Claims — What They Mean

sub (Subject): identifies the user or entity the token was issued for. iss (Issuer): identifies who issued the token. aud (Audience): the recipients the token is intended for. exp (Expiration): Unix timestamp when the token expires. iat (Issued At): Unix timestamp when the token was issued. nbf (Not Before): token is not valid before this timestamp. jti (JWT ID): unique identifier for the token to prevent replay attacks.

Decoding vs Verifying a JWT

Decoding reads the header and payload without checking the signature. Anyone can decode a JWT — the data in the payload is just Base64-encoded, not encrypted. Verifying checks the signature using the secret key to confirm the token was issued by a trusted party and hasn't been modified. This tool decodes only — signature verification requires the secret key, which you should never share with a third-party tool.

Paste the JWT above. The header and payload are Base64url-decoded and displayed as JSON. No server call is made — everything runs in your browser.

The decoding happens entirely in your browser — the token is never sent to any server. However, avoid pasting production tokens with sensitive scopes. For development/debugging, this tool is safe.

No — signature verification requires the secret key. This tool decodes the header and payload only. Never share your JWT secret with any online tool.

The exp claim is a Unix timestamp. If it's in the past, the token has expired and will be rejected by the server. You need to obtain a new token (usually by re-authenticating or using a refresh token).

Related Tools