JWT Decoder
Decode and inspect JSON Web Tokens
Calculator
About JWT Tokens
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. JWTs are commonly used for authentication.
How to Use
Decode and inspect JWT tokens to view their contents
Paste your JWT
Copy your JWT token and paste it into the input field. The token should have three parts separated by dots.
Click Decode
Click the Decode button to parse and decode the JWT token into its three components.
View Header
See the decoded header showing the algorithm (alg) and token type (typ).
Inspect Payload
View the payload containing claims like user ID, email, roles, and timestamps.
Check Expiration
See the expiration status and human-readable dates for iat, exp, and nbf claims.
Frequently Asked Questions
A JWT is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: a header (algorithm and token type), a payload (claims/data), and a signature for verification. JWTs are commonly used for authentication and authorization in web applications.
Yes, decoding JWTs online is safe because the header and payload are only Base64URL encoded, not encrypted. Anyone can decode them. However, you should never share tokens containing sensitive data. The signature cannot be verified without the secret key, so decoding only reveals the claims, not whether the token is valid.
Check the "exp" (expiration) claim in the payload. It contains a Unix timestamp of when the token expires. If the current time is greater than the exp value, the token is expired. Our decoder automatically calculates and displays the expiration status.
Common claims include: "iss" (issuer), "sub" (subject), "aud" (audience), "exp" (expiration time), "nbf" (not before), "iat" (issued at), and "jti" (JWT ID). Custom claims can also be added to store application-specific data.
JWTs have three parts: 1) Header - contains the signing algorithm (e.g., HS256, RS256) and token type. 2) Payload - contains the claims (user data, expiration, etc.). 3) Signature - created by signing the header and payload with a secret key. These are Base64URL encoded and joined with dots.
Developer Tools
Code formatters, minifiers, converters, and developer utilities