JWT Decoder
Decode and inspect JSON Web Tokens entirely in your browser. No data is sent to any server.
What is a JWT Token?
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact, self-contained method for securely transmitting information between parties as a JSON object. JWTs are widely used for authentication and authorization in modern web applications.
JWT Structure
A JWT consists of three Base64Url-encoded parts separated by dots:
- Header: Contains the token type and signing algorithm (e.g., HS256, RS256).
- Payload: Contains the claims (statements about the user and metadata).
- Signature: Created by signing the encoded header and payload with a secret key.
Common JWT Claims
sub- Subject (who the token is about)iss- Issuer (who created the token)exp- Expiration time (Unix timestamp)iat- Issued at (when the token was created)aud- Audience (who the token is intended for)
Frequently Asked Questions
Is my token data secure?
Yes. All decoding happens entirely in your browser using JavaScript. No token data is sent to our servers. This tool only decodes the Base64Url-encoded parts; it does not verify or sign tokens.
Can I decode a token without the secret?
The header and payload are simply Base64Url-encoded (not encrypted), so anyone can decode them. The signature, however, requires the original secret key to verify.
What does "expired" mean?
If the exp claim's timestamp is in the past, the token has expired. Most authentication systems will reject expired tokens.