JWT Decoder
Decode and inspect JWT tokens — view header, payload, claims, expiry, and signature info without a secret key.
About JWT Decoder
JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims between two parties. A JWT consists of three Base64url-encoded parts separated by dots: the header (algorithm and token type), the payload (claims — the actual data), and the signature (verification hash). This decoder reveals the header and payload instantly without needing the secret key — the signature cannot be verified without it, but the claims are always readable.
Common JWT claims include: iss (issuer), sub (subject/user ID), aud (audience), exp (expiration timestamp), iat (issued at timestamp), nbf (not before), and jti (JWT ID). This decoder shows all claims with human-readable timestamps for exp and iat, making it easy to check if a token is expired or inspect what permissions it grants.
Important: JWTs are encoded, not encrypted. The payload is visible to anyone. Never store sensitive data (passwords, credit cards) in a JWT payload. Use encrypted JWTs (JWE) if you need confidentiality.