Paste any JWT and instantly see the decoded header, payload, all claims, and expiry status. Nothing is sent to any server.
A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange between parties. JWTs are signed — meaning recipients can verify their authenticity — and optionally encrypted. They are widely used in REST APIs, single-page applications, mobile apps, and microservices for stateless authentication.
A JWT consists of three base64url-encoded parts separated by dots: Header.Payload.Signature. The header specifies the token type and signing algorithm (e.g., HS256, RS256). The payload contains claims — key-value pairs asserting information about the subject. The signature is a cryptographic hash of the header and payload, signed with a secret or private key — it proves the token was not tampered with.
sub (Subject) — identifies who the token is about, typically a user ID. iss (Issuer) — identifies who issued the token. aud (Audience) — identifies the intended recipients. exp (Expiry) — Unix timestamp after which the token must be rejected. iat (Issued At) — Unix timestamp when the token was issued. nbf (Not Before) — token must not be accepted before this time.
JWTs are encoded, not encrypted. The payload is readable by anyone who holds the token. Never store sensitive information (passwords, credit card numbers, SSNs) in JWT payloads. Always verify the signature server-side — a decoded JWT means only that the data is readable, not that it is authentic. Use this decoder only for debugging with non-production tokens.