JWT Decoder & Debugger
Decode JSON Web Tokens instantly. View header, payload claims, signature, and expiration status — all in your browser.
Algorithm (alg)
Token type (typ)
Key ID (kid)
iss — Issuer
sub — Subject
aud — Audience
exp — Expiration
iat — Issued At
nbf — Not Before
HS256 — HMAC SHA-256
RS256 — RSA SHA-256
ES256 — ECDSA P-256
header.payload.signature
Base64URL encoded
Dot-separated parts
API authentication
OAuth 2.0 / OIDC
Stateless sessions
What is a JSON Web Token (JWT)?
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe token format defined in RFC 7519. It enables secure information exchange between two parties as a JSON object that is digitally signed. JWTs are commonly used for authentication and authorization in web applications, APIs, and microservices architectures.
JWT Token Structure
Every JWT consists of three parts separated by dots (.):
- Header: Contains the signing algorithm (e.g., HS256, RS256) and token type (JWT). It's Base64URL-encoded JSON.
- Payload: Contains claims — statements about the user or entity, plus metadata like expiration time. Also Base64URL-encoded JSON.
- Signature: Created by signing the encoded header and payload with a secret key (HMAC) or private key (RSA/ECDSA). Used to verify the token hasn't been tampered with.
Standard JWT Claims
| Claim | Name | Description |
|---|---|---|
iss | Issuer | Identifies who issued the JWT |
sub | Subject | Identifies the subject (usually a user ID) |
aud | Audience | Identifies the intended recipient(s) |
exp | Expiration | Unix timestamp after which the token is invalid |
nbf | Not Before | Unix timestamp before which the token is not valid |
iat | Issued At | Unix timestamp when the token was created |
jti | JWT ID | Unique identifier to prevent token replay |
Decoding vs Verifying a JWT
Decoding simply means reading the header and payload by Base64URL-decoding them. No secret key is required — anyone with the token can read the claims. Verifying means checking the signature against the secret or public key to confirm the token hasn't been altered. Always verify JWTs on the server side before trusting their claims.
Frequently Asked Questions
What is a JWT token?
A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It consists of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims like issuer, subject, and expiration), and a cryptographic signature. JWTs are widely used for authentication, authorization, and secure information exchange between services.
How do I decode a JWT token?
Paste your JWT token into the input field on this page. The header and payload are Base64URL-encoded JSON, so they can be decoded without the secret key. The tool instantly parses and displays the header (algorithm, type), all payload claims with descriptions, and the signature in hexadecimal format.
Can I verify a JWT signature with this tool?
This tool decodes and inspects JWTs but does not verify signatures, as that requires the secret key or public key. The signature is displayed in hexadecimal format so you can inspect it. For signature verification, you need the signing key and a JWT library in your application code.
Is it safe to paste my JWT token here?
Yes. All decoding happens entirely in your browser using JavaScript. No data is sent to any server. Your token never leaves your device. However, remember that JWT payloads are only encoded, not encrypted — anyone with the token can read the claims.
What are standard JWT claims?
Standard (registered) JWT claims defined in RFC 7519 include: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). These claims are optional but provide interoperable metadata about the token's purpose and validity.
How do I check if a JWT token is expired?
This tool automatically checks the exp (expiration) claim in the payload. If the token has expired, it shows how long ago it expired. If it's still valid, it shows a countdown to expiration. The expiration status is displayed prominently with color coding — green for valid, red for expired.
What is the difference between JWT decoding and JWT verification?
Decoding a JWT means reading the header and payload by Base64URL-decoding them — no secret key is needed. Verification means checking that the signature is valid using the secret key (HMAC) or public key (RSA/ECDSA). Decoding tells you what the token says; verification tells you if it's trustworthy.
Related Tools
- Base64 Encoder & Decoder — Encode and decode Base64 strings with file upload and URL-safe mode.
- Regex Tester — Test and debug regular expressions online with real-time highlighting.