JWT Decoder
Decode and analyze JSON Web Tokens. Tokens never leave your browser.
How JWT Decoder Works
What is a JSON Web Token?
A JWT is a compact, URL-safe token used for authentication and information exchange. It consists of three Base64url-encoded parts separated by dots: Header, Payload, and Signature.
The header specifies the algorithm, the payload carries the claims (user data, expiration, etc.), and the signature verifies integrity.
How to Use
- Paste a token, usually starting with
eyJ; the output updates as you type. ABearerprefix, quotes and line breaks are removed. - Header and payload are shown as indented JSON, exactly as written in the token, so large numbers keep every digit.
- The line under the output names the signature, the times in UTC and anything to watch out for, such as an expired or unsigned token.
- The dice loads a random example: valid, expired, not yet valid, unsigned, encrypted and more.
JWT Structure
| Header | Algorithm (alg) and token type (typ) |
| Payload | Claims: sub, iat, exp, iss, aud, custom data |
| Signature | HMAC, RSA, ECDSA or EdDSA signature over header and payload, to show the token was not changed |
| Encrypted | A JWE has five parts; its payload can only be read with the recipient's key |
Important Notes
- This tool only decodes tokens and does not verify signatures. An HMAC token (
HS256) is verified with the shared secret, an RSA, ECDSA or EdDSA token with the issuer's public key. - A signed JWT is not encrypted. Anyone with the token can read the payload, so it should never carry secrets.
- A server has to check the signature and the times (
exp,nbf) before it trusts a token.
Privacy & Security: All decoding runs entirely in your browser. No tokens are sent to any server.