Developer Tools

JWT Decoder

Decode and inspect JWT header, payload, and claims instantly. Shows expiry status and all token fields — fully private, nothing sent to a server.

Header & Payload
Expiry Status
Claims
Private
Browser-only

JWT Token

Paste a JWT token and click Decode

Header, payload, and signature decoded and displayed

JSON Web Token (JWT) Architecture & Decoding (RFC 7519)

A JSON Web Token (JWT) is an open standard (RFC 7519) defining a compact, URL-safe container for securely transmitting claims between distributed parties. JWTs are ubiquitously utilized in modern OAuth 2.0 and OpenID Connect identity architectures as stateless authentication bearer tokens.

Anatomy of a JWT String

A standard JWT string consists of three separate base64url-encoded parts delimited by periods (.):

header.payload.signature

Token Segment	Typical Contents	Function
Header	`{"alg": "HS256", "typ": "JWT"}`	Specifies cryptographic signing algorithm and token format
Payload (Claims)	`{"sub": "123", "name": "Alice", "exp": 1789929600}`	Contains identity claims, permissions, and expiration timestamps
Signature	Cryptographic HMAC or RSA hash	Verifies token integrity and authenticity using private key or secret

Standard Registered Claims (RFC 7519)

iss (Issuer): Principal issuing the JWT.
sub (Subject): Unique user or client ID.
exp (Expiration Time): Unix timestamp past which the token must be rejected.
nbf (Not Before): Unix timestamp before which the token cannot be accepted.
iat (Issued At): Timestamp marking token creation.

Decoding JWTs Client-Side in Code

JavaScript

function decodeJwtPayload(token) {
  try {
    const base64Url = token.split('.')[1];
    const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
    const jsonPayload = decodeURIComponent(
      atob(base64)
        .split('')
        .map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
        .join('')
    );
    return JSON.parse(jsonPayload);
  } catch (err) {
    return { error: 'Invalid JWT format' };
  }
}

Frequently Asked Questions

Can sensitive personal information be stored in a JWT payload?: No. The JWT payload is only Base64URL-encoded, not encrypted. Anyone who intercepts the token can decode and view claims, so sensitive secrets, passwords, or PII should never be placed in unencrypted JWTs.
What is the difference between JWT decoding and JWT verification?: Decoding extracts readable JSON claims from the payload without checking authenticity. Verification recalculates the cryptographic signature against a secret or public key to ensure the token has not been tampered with.
What is a JWT?: A JSON Web Token (JWT) is a compact, URL-safe token format for representing claims between two parties. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. JWTs are widely used for authentication and API authorization.
Is this tool safe to use with real tokens?: For sensitive production tokens, exercise caution. This tool decodes entirely in your browser - nothing is sent to a server. However, avoid pasting live access tokens with sensitive permissions into any online tool as a best practice.
Does this tool verify the JWT signature?: No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256/ES256). This tool only decodes (Base64URL-decodes) the header and payload - it does not validate the signature.
What does 'exp' and 'iat' mean?: 'iat' (Issued At) is the Unix timestamp when the token was issued. 'exp' (Expiration Time) is the Unix timestamp when the token expires. The decoder automatically converts these to human-readable dates and shows whether the token is expired.
What JWT algorithms are common?: HS256 (HMAC + SHA-256) is the most common symmetric algorithm, using a shared secret. RS256 (RSA + SHA-256) and ES256 (ECDSA + SHA-256) are asymmetric algorithms using a public/private key pair. The algorithm is specified in the JWT header's 'alg' field.
What is the JWT payload?: The payload contains claims - statements about the subject. Standard claims include sub (subject/user ID), iss (issuer), exp (expiration), iat (issued at), and aud (audience). Custom claims can contain any JSON data the application needs.

Accuracy & Advisory Notice: JWT Decoder

This website and utility are provided for general informational, calculation, and educational purposes only. Always verify critical computation outputs prior to professional deployment or financial use. See our Terms of Service and Privacy Policy for full governance details.

Loading tool...

JSON Web Token (JWT) Architecture & Decoding (RFC 7519)

Anatomy of a JWT String

A standard JWT string consists of three separate base64url-encoded parts delimited by periods (.):

header.payload.signature

Token Segment

Typical Contents

Function

Header

{"alg": "HS256", "typ": "JWT"}

Specifies cryptographic signing algorithm and token format

Payload (Claims)

{"sub": "123", "name": "Alice", "exp": 1789929600}

Contains identity claims, permissions, and expiration timestamps

Signature

Cryptographic HMAC or RSA hash

Verifies token integrity and authenticity using private key or secret

Decoding JWTs Client-Side in Code

JavaScript

function decodeJwtPayload(token) { try { const base64Url = token.split('.')[1]; const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/'); const jsonPayload = decodeURIComponent( atob(base64) .split('') .map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)) .join('') ); return JSON.parse(jsonPayload); } catch (err) { return { error: 'Invalid JWT format' }; } }

Frequently Asked Questions

Can sensitive personal information be stored in a JWT payload?

No. The JWT payload is only Base64URL-encoded, not encrypted. Anyone who intercepts the token can decode and view claims, so sensitive secrets, passwords, or PII should never be placed in unencrypted JWTs.

What is the difference between JWT decoding and JWT verification?

Decoding extracts readable JSON claims from the payload without checking authenticity. Verification recalculates the cryptographic signature against a secret or public key to ensure the token has not been tampered with.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format for representing claims between two parties. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. JWTs are widely used for authentication and API authorization.

Is this tool safe to use with real tokens?

For sensitive production tokens, exercise caution. This tool decodes entirely in your browser - nothing is sent to a server. However, avoid pasting live access tokens with sensitive permissions into any online tool as a best practice.

Does this tool verify the JWT signature?

No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256/ES256). This tool only decodes (Base64URL-decodes) the header and payload - it does not validate the signature.

What does 'exp' and 'iat' mean?

'iat' (Issued At) is the Unix timestamp when the token was issued. 'exp' (Expiration Time) is the Unix timestamp when the token expires. The decoder automatically converts these to human-readable dates and shows whether the token is expired.

What JWT algorithms are common?

HS256 (HMAC + SHA-256) is the most common symmetric algorithm, using a shared secret. RS256 (RSA + SHA-256) and ES256 (ECDSA + SHA-256) are asymmetric algorithms using a public/private key pair. The algorithm is specified in the JWT header's 'alg' field.

What is the JWT payload?

The payload contains claims - statements about the subject. Standard claims include sub (subject/user ID), iss (issuer), exp (expiration), iat (issued at), and aud (audience). Custom claims can contain any JSON data the application needs.