JWT Decoder.
Paste any JWT to see its decoded header, payload, expiry, and signature.
Paste any JWT token above to decode it.
Standard JWT claim reference.
The registered claim names defined in the JWT specification (RFC 7519).
| Claim | Section | Meaning |
|---|---|---|
| alg | Header | Algorithm used to sign the token (e.g. HS256, RS256, ES256) |
| typ | Header | Token type — always "JWT" for JSON Web Tokens |
| sub | Payload | Subject — identifies the principal (usually a user ID) |
| iss | Payload | Issuer — identifies the party that issued the token |
| aud | Payload | Audience — the recipient(s) the token is intended for |
| exp | Payload | Expiration time — Unix timestamp after which the token is invalid |
| iat | Payload | Issued At — Unix timestamp of when the token was created |
| nbf | Payload | Not Before — Unix timestamp before which the token must not be accepted |
| jti | Payload | JWT ID — unique identifier to prevent token replay |
Capabilities
What You Get
Inspect a token's real contents — header, claims, and expiry — without pasting it into someone else's server.
Header And Payload
Both segments decoded and pretty-printed as readable JSON.
Expiry Check
Reads exp and iat and tells you whether the token is still valid.
Claim Reference
Registered RFC 7519 claims explained alongside the decoded values.
Signature Shown
The third segment is displayed, so you can compare it by eye.
Malformed Input
Broken tokens report what is wrong instead of failing silently.
Never Uploaded
Decoding is local — production tokens never reach a third party.
Related tools.
More free browser-based utilities, connected by category and use case.
Base64 Encoder / Decoder
Encode or decode Base64 strings and files instantly. Also handles URL encoding/decoding and HTML entity encoding. Useful for auth headers, data URIs, and API payloads.
JSON Formatter & Diff
Paste raw or minified JSON to format, validate, and syntax-highlight it. Switch to diff mode to compare two JSON blobs side by side and see exactly what changed.
API Mock Builder
Define a JSON schema using a visual builder or raw JSON and generate a realistic mock API response. Set status codes, headers, and response delay. Copy as fetch snippet or curl command.
FAQ
JWT Decoder FAQ.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It encodes claims (statements about an entity) as a JSON object that is signed — ensuring it hasn't been tampered with. JWTs are widely used for authentication and information exchange in web applications and APIs.
What are the three parts of a JWT?
A JWT has three Base64URL-encoded parts separated by dots: 1) Header — contains the token type and signing algorithm. 2) Payload — contains the claims (user data, expiry, etc.). 3) Signature — the HMAC or RSA signature that verifies the token's integrity.
Can you verify a JWT with this tool?
No. Verification requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA). This tool only decodes the Base64URL-encoded parts to make them readable. Never share your signing secret with any online tool.
Is it safe to paste my JWT here?
This tool runs entirely in your browser — no data is sent to any server, logged, or stored. That said, JWTs can contain sensitive user information. Use test/development tokens for online tools and keep production tokens in secure environments.
What does 'exp' mean in a JWT payload?
exp is the expiration claim — a Unix timestamp (seconds since January 1, 1970 UTC) after which the token should be considered invalid. This tool converts the raw timestamp to a human-readable date and marks the token as expired if the current time is past the expiry.
What is the difference between HS256 and RS256?
HS256 (HMAC-SHA256) uses a single shared secret for both signing and verification — suitable for internal services where you control both sides. RS256 (RSA-SHA256) uses a private key to sign and a public key to verify — better for distributed systems where the verifier shouldn't have the signing key.
