JWT Decoder
Inspect JWT header and payload claims — client-side only, nothing leaves your browser.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe format for transmitting claims between parties. A JWT has three Base64url-encoded parts separated by dots: the header (algorithm and token type), the payload (claims — user ID, roles, expiry, etc.), and the signature (used to verify authenticity). JWTs are widely used for authentication in REST APIs and single-page apps.
Frequently asked questions
Does this verify the signature?
No. Verifying the signature requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA). This tool only decodes and displays the header and payload — it cannot confirm that the token was issued by a trusted party or that it has not been tampered with. For that, verify the token server-side using your auth library.
What are standard JWT claims?
RFC 7519 defines registered claim names: iss (issuer), sub (subject), aud (audience), exp (expiry time, Unix timestamp), nbf (not before), iat (issued at), and jti (JWT ID). Applications may add custom claims alongside these.
Why is the payload readable without the secret?
JWT payloads are Base64url-encoded, not encrypted. Anyone who holds a JWT token can read its claims — the signature only proves it was issued by a holder of the secret, not that the contents are private. If you need the payload to be confidential, use JWE (JSON Web Encryption) instead of JWS (JSON Web Signature).
