Skip to content

JWT Decoder

Decode JSON Web Tokens to inspect the header, payload and expiry. Decoding happens locally; nothing is uploaded.

Anatomy of a JWT

A JSON Web Token (RFC 7519) is three Base64URL-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm (for example HS256 or RS256), the payload carries claims, and the signature lets a server confirm that nobody tampered with the first two parts.

Registered claims

ClaimMeaning
issIssuer
subSubject (usually the user ID)
audAudience the token is meant for
expExpiry time (Unix seconds)
nbfNot valid before
iatIssued at
jtiUnique token ID

Security notes

  • Decoding isn't verifying. Anyone can read a JWT payload, so never put secrets in it.
  • Always verify the signature and check exp, aud and iss on the server with a maintained library.
  • Reject alg: none, and pin the algorithms you accept.
  • Keep access tokens short-lived and use refresh tokens for longer sessions.
  • Don't paste production tokens into online tools you don't trust. This one runs only in your browser.