JWT Decoder — Inspect JSON Web Token Claims & Headers
Understanding the Basics
JSON Web Tokens (JWTs) are a compact, self-contained mechanism for securely transmitting information between parties as a digitally signed JSON object, standardized in RFC 7519. A JWT consists of three Base64URL-encoded segments separated by dots: the Header, the Payload (claims), and the Signature. The Header declares the token type (JWT) and the signing algorithm (HS256, RS256, ES256, etc.). The Payload contains claims — statements about the entity (typically a user) and additional metadata. Standard claims include iss (issuer), sub (subject/user ID), aud (audience), exp (expiration time), iat (issued at time), and nbf (not before time). The Signature is computed by signing the Header and Payload with a secret key (for HMAC algorithms) or a private key (for RSA/ECDSA algorithms), ensuring the token has not been tampered with since issuance. JWTs are the backbone of modern authentication systems: OAuth 2.0 access tokens, OpenID Connect ID tokens, API authentication in microservices, and stateless session management all rely on JWTs. Decoding a JWT reveals its claims without verification — useful for debugging authentication flows, inspecting token expiration, and auditing what information is embedded in tokens.
How to Use the Tool
- Paste your JWT (the three-part dot-separated string) into the input field.
- The tool splits the token at the dots and Base64URL-decodes the Header and Payload sections.
- The decoded Header shows the algorithm and token type; the decoded Payload shows all claims.
- Unix timestamps in exp, iat, and nbf claims are automatically converted to human-readable local dates.
- The Signature section is displayed as a hex string — note that signature verification requires the secret or public key, which this tool does not perform.
Key Features & Specifications
- Decodes JWT Header and Payload from Base64URL to readable JSON
- Automatically converts exp, iat, and nbf Unix timestamps to human-readable date strings
- Displays claim explanations (standard claim names like sub, iss, aud are annotated)
- Shows whether the token is expired based on the exp claim compared to current time
- Handles JWTs with custom claims and non-standard payload fields
Frequently Asked Questions (FAQ)
- Q:Does this tool verify the JWT signature?
- No. Decoding and verifying are distinct operations. Decoding only Base64URL-decodes the Header and Payload segments — it does not validate the cryptographic signature. Signature verification requires the secret (for HMAC) or public key (for RSA/ECDSA) and must be performed server-side in a trusted environment.
- Q:Is it safe to paste my JWT tokens here?
- This tool processes JWTs entirely in your browser — no data is transmitted to a server. However, be cautious with access tokens that grant sensitive permissions. If the token has been rotated or has a short expiration, the risk of exposure is minimal. Never paste long-lived refresh tokens into any online tool.
- Q:What does "algorithm: none" in the JWT header mean?
- An algorithm value of "none" indicates an unsecured JWT with no digital signature. This is a severe security vulnerability if accepted by a server — it means any attacker can forge arbitrary claims. Never accept "alg: none" tokens in production systems without explicit justification.
- Q:What is the difference between a JWT, a JWS, and a JWE?
- JWT (RFC 7519) is the claim container format. JWS (JSON Web Signature, RFC 7515) is a JWT with a digital signature — the most common form. JWE (JSON Web Encryption, RFC 7516) is a JWT where the payload is encrypted (not just signed), making the claims confidential to parties without the decryption key.