🎫 JWT Decoder

Decode JSON Web Tokens (JWT) to inspect header, payload, and signature — entirely in your browser.

What is a JSON Web Token (JWT)?

JWT is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS).

JWT Structure

  • Header: Contains the signing algorithm (e.g., HS256, RS256) and token type. Contains the signing algorithm (e.g., HS256, RS256) and token type.
  • Payload: Contains claims — statements about the user and additional metadata. Contains claims — statements about the user and additional metadata.
  • Signature: Verifies the token hasn't been tampered with. Verifies the token hasn't been tampered with. Created using the header, payload, and a secret key.

Frequently Asked Questions

Is it safe to decode a JWT here?

Yes! This tool runs entirely in your browser. Your token is never sent to any server. You can verify this in your browser's network tab.

What does token expiration mean?

The 'exp' claim in a JWT indicates when the token expires. After this time, the token should be rejected by the server.

Decodes JSON Web Tokens showing header, payload, and signature without requiring the secret key, for debugging auth flows.

Key Facts

  • Standardized in RFC 7519 (2015)
  • 80%+ of modern APIs use JWT
  • Three parts separated by dots (.)
  • Common algorithms: HS256, RS256

Frequently Asked Questions

What is a JWT?

Compact, URL-safe token with header (algorithm), payload (claims), and signature for API authentication.

Is decoding JWT safe?

Yes — payload is base64-encoded, not encrypted. Security is in signature verification, not content hiding.

What are JWT claims?

Statements about user: iss (issuer), sub (subject), exp (expiration), iat (issued at), aud (audience).

How long should JWT last?

Access tokens: 15-30 min. Refresh tokens: 7-30 days. Short-lived limits damage if compromised.

Related Developer Tools

📋 JSON Formatter & Validator 🔐 Hash Generator 📦 Base64 Encoder/Decoder 🔗 URL Encoder/Decoder