JWT Decoder & Parser

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe means of representing claims between two parties. JWTs are the backbone of modern authentication — used by OAuth 2.0, OpenID Connect, and virtually every API that needs to verify a user's identity.

A JWT consists of three Base64URL-encoded parts separated by dots:

• Header — contains the algorithm (alg) and token type (typ)
• Payload — contains claims like user ID (sub), issued time (iat), and expiration (exp)
• Signature — a cryptographic hash that verifies the token hasn't been tampered with

Why Developers Need a JWT Decoder

• Debugging authentication flows — see what claims your server is issuing
• Checking token expiration without writing code
• Verifying the correct algorithm is being used (e.g., RS256 vs HS256)
• Inspecting third-party tokens from OAuth providers like Google, GitHub, Auth0
• Teaching and learning how JWT-based authentication works

How to Use This Tool

1. Paste your JWT into the input area.
2. Click "Decode Token" to split and decode all three parts.
3. View the Header, Payload, and Signature sections below.
4. If the token contains iat or exp claims, the tool shows whether the token is still valid.

Common JWT Claims

• sub — Subject (usually a user ID)
• iss — Issuer (who created the token)
• aud — Audience (who the token is intended for)
• exp — Expiration time (Unix timestamp)
• iat — Issued at (Unix timestamp)
• nbf — Not before (token is invalid before this time)
• jti — JWT ID (unique identifier for the token)

Frequently Asked Questions

Is it safe to paste my JWT here?

Yes. This tool runs entirely in your browser using JavaScript. No data is transmitted to any server. You can verify by disconnecting your internet — the tool still works perfectly.

Can this tool verify JWT signatures?

This tool decodes and displays JWTs. Full signature verification requires the secret key or public certificate, which should never be shared in a client-side tool. For production verification, use server-side libraries like jsonwebtoken (Node.js), firebase/php-jwt (PHP), or PyJWT (Python).

What algorithms do JWTs support?

Common algorithms include HS256 (HMAC-SHA256), RS256 (RSA-SHA256), ES256 (ECDSA-SHA256), and EdDSA. The algorithm is specified in the JWT header's alg field.