JWT Decoder & Inspector

Decode JSON Web Tokens instantly. Decodes client-side only, your secret tokens never touch any server.

Private by architecture: All processing is 100% client-side memory. Your data never leaves this browser tab.

Paste a token to inspect its claims, algorithm, and expiration.

Encoded JWT Token

0 charsToken

Decoded Payload & Header

0 charsJSON Payload

Understanding JSON Web Tokens (JWT)

JSON Web Tokens (RFC 7519) are a compact, URL-safe means of transmitting claims between two parties. The claims in a JWT are encoded as a JSON object that is digitally signed using JSON Web Signature (JWS).

🔴 Header

Contains metadata about the token, including the signing algorithm (e.g. HS256, RS256, ES256) and the token type (JWT).

🟣 Payload

Contains the claims. Includes registered standard claims (exp, sub, iat, iss) as well as custom user and role authorization data.

🔵 Signature

Calculated by hashing the Base64URL-encoded header and payload with a secret or private key, guaranteeing data integrity.

Common Registered Claims Reference

Claim	Full Name	Description	Example Value
`iss`	Issuer	Identifies the principal that issued the JWT	`"https://auth.example.com"`
`sub`	Subject	Identifies the user or resource the token represents	`"user_98317a6c"`
`aud`	Audience	Identifies the recipients that the JWT is intended for	`"https://api.example.com"`
`exp`	Expiration Time	Unix epoch timestamp after which the token must be rejected	`1735689600`
`nbf`	Not Before	Unix epoch timestamp before which the token is not valid	`1704067200`
`iat`	Issued At	Unix epoch timestamp indicating when the token was signed	`1704067200`

Critical Security Considerations

JWTs are NOT Encrypted: A signed JWT (JWS) provides integrity, NOT confidentiality. Any client or network observer can decode the Base64 payload. Never store passwords, private keys, or raw personal data in claims.
Beware of the alg: none Attack: Vulnerable verification libraries once allowed attackers to change the header to { "alg": "none" } and submit unsigned tokens with forged claims. Modern servers must explicitly enforce expected signing algorithms.
Always Verify Expiration: Servers and gateways must check that current time is before expiration (t < exp) with a tight clock-skew tolerance (typically 30-60 seconds).

Frequently Asked Questions

Is it safe to paste confidential production JWT tokens here?

Yes. The decoding process runs 100% inside your browser JavaScript engine using native Base64URL decoding and JSON.parse(). Unlike third-party token inspectors that send tokens to remote web servers, your private claims, user IDs, and signatures are never transmitted over the network.

What is the structural format of a JSON Web Token?

A standard JWT consists of three Base64URL-encoded strings joined by periods (header.payload.signature). The Header defines the cryptographic algorithm (such as HS256 or RS256). The Payload contains the claims. The Signature verifies that the token was signed by the holder of the private key.

Can anyone view the contents of an unencrypted JWT?

Yes. Standard JWTs are signed, not encrypted. The Base64URL encoding is reversible without any secret key. You should never store sensitive plaintext secrets (like passwords or unencrypted credit card numbers) in JWT claims.

What do the registered claims exp, iat, and nbf mean?

exp (Expiration Time) is a Unix epoch timestamp marking when the token expires. iat (Issued At) records when the token was created. nbf (Not Before) specifies the earliest timestamp at which the token can be accepted.

How do I verify the HMAC signature of my JWT?

To verify signatures client-side, navigate to our JWT Signer & Verifier tool (/jwt-signer), where you can enter your secret key and verify HS256, HS384, or HS512 signatures using the browser Web Crypto API without disclosing keys to any server.

About This Tool

JWT Decoder splits a token into its header and payload, Base64URL-decodes both, and shows them as one formatted JSON object alongside the algorithm and expiration status, all with JSON.parse in the browser, nothing sent over the network.

This only decodes; it doesn't check the signature. To verify an HMAC-signed token, or to sign a new one, use JWT Signer & Verifier instead.

Key Features

Algorithm & expiry at a glance: a single status line shows the signing algorithm plus issued/expiry times and ACTIVE/EXPIRED state.
Combined header + payload view: both decode into one formatted JSON object instead of two separate panels.
Clear structural error reporting: malformed or incomplete tokens surface a specific error instead of failing silently.
Copy or download: export the decoded payload as JSON in one click.
Sample token: one click loads a working JWT to try the decoder on.
Keyboard-driven: Cmd/Ctrl+Enter decodes without leaving the keyboard.