JWT Decoder - Decode and Verify JSON Web Tokens

Decode JWT tokens to see header, payload, and signature. Verify token validity and expiration. Free, private, works offline.

JWT Token

Header

Paste a JWT to decode

Payload

Paste a JWT to decode

Signature

Paste a JWT to decode

Decoded Claims

No claims to display

SAML Decoder - Decode SAML Assertions & …

View all Jwt decoders →

Frequently Asked Questions

JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange. It contains three parts separated by dots: header (algorithm), payload (claims), and signature (verification).

Basic verification is supported for HS256 (HMAC) if you provide the secret. RS256/ES256 verification requires the public key which isn't fully supported in-browser for security reasons.

JWT payload is Base64-URL encoded, not encrypted - anyone can decode and read it. The signature verifies authenticity, not confidentiality. Never put sensitive data in JWT payload without encryption.

Header (algorithm and token type), Payload (claims like user ID, expiration), and Signature (cryptographic hash for verification). Each part is Base64-URL encoded and separated by dots.

JWT payloads are encoded, not encrypted. The signature verifies the token wasn't tampered with, but the content is readable. This is by design - JWTs are for verification, not secrecy.

The decoder shows the exp (expiration) and iat (issued at) claims in human-readable format and warns if the token is expired. Expired tokens should be rejected by servers even if the signature is valid.

JWTs are stateless - servers verify without database lookup. Session cookies require server-side session storage. JWTs work well for APIs and microservices; sessions for traditional web apps.

Yes, but never paste production secrets into online tools. You can decode the payload safely (it's public), but don't verify signatures with production keys on untrusted sites.

Standard claims: iss (issuer), sub (subject/user ID), aud (audience), exp (expiration time), iat (issued at), nbf (not before). Custom claims vary by application.

Yes. All decoding happens in your browser using JavaScript. No token data is sent to any server. Never share your secret keys, even though this tool is client-side only.

Header

Payload

Signature

Related Tools