JWT Decoder
Decode and inspect JSON Web Tokens instantly.
Paste a JWT (JSON Web Token) to decode and view its header, payload, and signature. See claim details, expiry status, and more.
Security Warning: Never paste production tokens containing sensitive data into online tools. This decoder runs entirely in your browser - your tokens are not sent to any server.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. JWTs are commonly used for:
- Authentication: After login, subsequent requests include the JWT to access protected resources
- Information Exchange: Securely transmitting information between parties
- Authorization: Determining what resources a user can access
JWT Structure
A JWT consists of three parts separated by dots (.):
- Header: Contains the token type and signing algorithm (e.g., HS256, RS256)
- Payload: Contains the claims - statements about the user and additional metadata
- Signature: Used to verify the token hasn't been tampered with
Standard Claims
| Claim | Name | Description |
|---|---|---|
iss | Issuer | Who issued the token |
sub | Subject | Who the token is about |
aud | Audience | Who the token is intended for |
exp | Expiration | When the token expires |
nbf | Not Before | When the token becomes valid |
iat | Issued At | When the token was issued |
jti | JWT ID | Unique identifier for the token |
Privacy Note
This tool decodes JWTs entirely in your browser. Your tokens are never transmitted to our servers. However, avoid pasting tokens containing sensitive data into any online tool.
Related Tools
- Base64 Encoder Encode/decode Base64 strings
- Hash Generator Generate MD5, SHA hashes
- JSON Formatter Format and validate JSON
Common Algorithms
- HS256: HMAC with SHA-256 (symmetric)
- HS384: HMAC with SHA-384 (symmetric)
- HS512: HMAC with SHA-512 (symmetric)
- RS256: RSA with SHA-256 (asymmetric)
- ES256: ECDSA with SHA-256 (asymmetric)