🔑 JWT Decoder & Inspector
Paste any JSON Web Token to decode and inspect its header, payload, and signature. 100% client-side — your tokens never leave your browser.
Token
Header
Payload
Signature
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe credential used to securely transmit information between parties as a JSON object. JWTs are widely used for authentication, session tokens, API keys, and OAuth 2.0 access tokens across web and mobile applications.
A JWT always has three parts separated by dots: header.payload.signature. Each part is Base64URL-encoded. The header declares the signing algorithm, the payload carries the claims (the data), and the signature is a cryptographic checksum that proves the token has not been tampered with.
How to decode a JWT online
- Step 1: Copy your JWT (it looks like a long string of letters, numbers, and dots).
- Step 2: Paste it into the "Token" field above. Decoding happens instantly as you type.
- Step 3: Inspect the decoded header, payload, and signature in the panels on the right.
- Step 4 (optional): To verify an HS256/HS384/HS512 signature, paste your shared secret into the verify field and click Verify.
Common JWT claims
| Claim | Meaning | Example |
|---|---|---|
iss | Issuer — who created and signed the token | "https://auth.example.com" |
sub | Subject — the user/entity the token is about | "user_42" |
aud | Audience — who the token is intended for | "my-api" |
exp | Expiration time (Unix seconds). Token is invalid after this. | 1893456000 |
nbf | Not-before — token not valid before this time | 1700000000 |
iat | Issued-at — when the token was created | 1700000000 |
jti | JWT ID — unique identifier (for revocation lists) | "a1b2c3d4" |
Is JWT decoding safe?
Decoding a JWT does not reveal the secret. The header and payload are Base64-encoded, not encrypted — anyone with the token can read them. The signature is what proves authenticity, and verifying it requires the secret (for HMAC) or the public key (for RSA/ECDSA).
This tool runs 100% in your browser. Your tokens are never sent to our servers, logged, or stored anywhere. Pasting a production token here is safe — but treat the token itself like a password and rotate it if it has leaked elsewhere.
Frequently Asked Questions
exp claim (Unix timestamp) against your browser's local time. A clock that's out of sync by even a few minutes can make a fresh token appear expired.base64(header).base64(payload) signed with the secret or private key. You can only meaningfully "decode" it by verifying it against the original data and key.