Developer Tools

JWT Decoder

Decode and inspect JWT header, payload, and claims instantly. Shows expiry status and all token fields — fully private, nothing sent to a server.

Header & Payload
Expiry Status
Claims
Private
Browser-only

JWT Token

Paste a JWT token and click Decode

Header, payload, and signature decoded and displayed

JWT decoder

A JSON Web Token is three Base64URL-encoded segments joined by periods: header.payload.signature. The header usually identifies the signing algorithm, the payload contains claims, and the signature protects integrity when verified with the correct key.

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature

This decoder parses header and payload JSON, displays the signature text, and converts numeric iat and exp claims into readable dates. It does not verify the signature because verification requires the issuer’s secret or public key.

Standard claims

Claim	Meaning
`iss`	Issuer
`sub`	Subject
`aud`	Audience
`exp`	Expiration timestamp
`iat`	Issued-at timestamp
`nbf`	Not-before timestamp
`jti`	Token identifier

Decoding is not authentication. Never paste production secrets into untrusted tools, and never treat a decoded payload as proof of identity.

Frequently Asked Questions

What is a JWT?: A JSON Web Token (JWT) is a compact, URL-safe token format for representing claims between two parties. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. JWTs are widely used for authentication and API authorization.
Is this tool safe to use with real tokens?: For sensitive production tokens, exercise caution. This tool decodes entirely in your browser - nothing is sent to a server. However, avoid pasting live access tokens with sensitive permissions into any online tool as a best practice.
Does this tool verify the JWT signature?: No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256/ES256). This tool only decodes (Base64URL-decodes) the header and payload - it does not validate the signature.
What does 'exp' and 'iat' mean?: 'iat' (Issued At) is the Unix timestamp when the token was issued. 'exp' (Expiration Time) is the Unix timestamp when the token expires. The decoder automatically converts these to human-readable dates and shows whether the token is expired.
What JWT algorithms are common?: HS256 (HMAC + SHA-256) is the most common symmetric algorithm, using a shared secret. RS256 (RSA + SHA-256) and ES256 (ECDSA + SHA-256) are asymmetric algorithms using a public/private key pair. The algorithm is specified in the JWT header's 'alg' field.
What is the JWT payload?: The payload contains claims - statements about the subject. Standard claims include sub (subject/user ID), iss (issuer), exp (expiration), iat (issued at), and aud (audience). Custom claims can contain any JSON data the application needs.

Disclaimer

This tool is provided for general informational and utility purposes only. Results may be inaccurate, incomplete, outdated, or contain errors. Always verify results before relying on or using them.

Some tools may use AI, automated processing, third-party services, or server-side processing. Do not rely on these tools as a substitute for professional advice.

Use at your own risk. BestToolOnline makes no guarantees regarding the accuracy, reliability, completeness, availability, or suitability of results, to the maximum extent permitted by applicable law.

See our Terms of Service and Privacy Policy for complete details.

Loading tool...

JWT decoder

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature

Standard claims

Claim

Meaning

iss

Issuer

sub

Subject

aud

Audience

exp

Expiration timestamp

iat

Issued-at timestamp

nbf

Not-before timestamp

jti

Token identifier

Decoding is not authentication. Never paste production secrets into untrusted tools, and never treat a decoded payload as proof of identity.

Frequently Asked Questions

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format for representing claims between two parties. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. JWTs are widely used for authentication and API authorization.

Is this tool safe to use with real tokens?

For sensitive production tokens, exercise caution. This tool decodes entirely in your browser - nothing is sent to a server. However, avoid pasting live access tokens with sensitive permissions into any online tool as a best practice.

Does this tool verify the JWT signature?

No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256/ES256). This tool only decodes (Base64URL-decodes) the header and payload - it does not validate the signature.

What does 'exp' and 'iat' mean?

'iat' (Issued At) is the Unix timestamp when the token was issued. 'exp' (Expiration Time) is the Unix timestamp when the token expires. The decoder automatically converts these to human-readable dates and shows whether the token is expired.

What JWT algorithms are common?

HS256 (HMAC + SHA-256) is the most common symmetric algorithm, using a shared secret. RS256 (RSA + SHA-256) and ES256 (ECDSA + SHA-256) are asymmetric algorithms using a public/private key pair. The algorithm is specified in the JWT header's 'alg' field.

What is the JWT payload?

The payload contains claims - statements about the subject. Standard claims include sub (subject/user ID), iss (issuer), exp (expiration), iat (issued at), and aud (audience). Custom claims can contain any JSON data the application needs.

Disclaimer

Some tools may use AI, automated processing, third-party services, or server-side processing. Do not rely on these tools as a substitute for professional advice.