JWT Decoder

Decode and inspect JSON Web Tokens instantly. View header, payload, and claims with human-readable explanations.

100% client-side. Your tokens never leave your browser.

Security notice: Never paste production tokens containing sensitive data into any third-party tool. This decoder runs entirely in your browser — no data is transmitted.

Understanding JSON Web Tokens

JSON Web Tokens (JWTs) are the backbone of modern authentication. Used by APIs, single-page applications, and mobile apps, they securely transmit identity and authorization data between services.

Our JWT Decoder lets you instantly inspect any JWT — see the signing algorithm, read all claims with human-readable explanations, check if the token is expired, and copy individual sections. All processing happens in your browser for maximum security.

Why Developers Love This Tool

Claim Explanations

Hover over any standard claim (iss, sub, exp, iat) to see what it means — perfect for learning JWT structure.

Expiration Status

See "Expires in 2h 15m" or "Expired 3 days ago" at a glance — no manual Unix timestamp conversion.

100% Client-Side

Your tokens never leave your browser. Zero API calls, zero server logging — complete privacy.

JWT Structure Explained

Header

Algorithm & Type

.

Payload

Claims & Data

.

Signature

Verification

Common JWT Claims

ClaimNameDescription
issIssuerWho created the token
subSubjectWho the token is about (user ID)
audAudienceWho the token is intended for
expExpirationWhen the token expires (Unix time)
iatIssued AtWhen the token was created
jtiJWT IDUnique identifier for the token

Frequently Asked Questions

What is a JSON Web Token?
A JWT is a compact, self-contained token format for securely transmitting data between parties. It's widely used for API authentication and authorization in modern web applications.
What are the three parts of a JWT?
Header (algorithm + type), Payload (claims/data like user info and expiration), and Signature (cryptographic proof that the token hasn't been tampered with).
What does the 'exp' claim mean?
The 'exp' (Expiration Time) claim is a Unix timestamp. After this time, the token should be rejected. Our decoder converts it to a human-readable date and shows a countdown.
Is it safe to decode JWTs online?
Our tool processes everything in your browser — no data is sent anywhere. For production tokens with sensitive data, use development/test tokens instead.
What's the difference between HS256 and RS256?
HS256 uses a shared secret (symmetric). RS256 uses a public/private key pair (asymmetric) — more secure for distributed systems since the public key can be shared freely.
Can I verify signatures here?
This tool decodes (reads) JWT content only. Signature verification needs the secret/public key, which shouldn't be entered into web tools for security reasons.