JWT Decoder

Decode and inspect JSON Web Token claims, headers, and expiration dates securely.

JWT Decoder

Encoded JWT (Header.Payload.Signature)
Decoded Claims & Header (JSON)

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT), defined in IETF RFC 7519, is a compact, URL-safe means of representing claims to be transferred between two parties. JWTs are the dominant authentication mechanism in modern single-page applications (SPAs), microservices, mobile apps, and OAuth 2.0 / OpenID Connect (OIDC) authentication flows.

A standard JWT string consists of three distinct parts separated by dots (.):

header.payload.signature
Critical Security Awareness: JWT is NOT Encryption A common misconception among developers is that JWT tokens hide confidential data. In a standard Signed JWT (JWS), both the Header and the Payload are merely Base64URL-encoded, meaning anyone with network access can read every claim inside the token without needing the signature key. Never place passwords or credit cards in a JWT payload!

Anatomical Breakdown of a JWT Token

1. The Header

The header consists of two fields: the signing algorithm being used (such as HS256 or RS256) and the token type (JWT): 

{
  "alg": "HS256",
  "typ": "JWT"
}

2. The Payload (Claims)

The payload contains the identity claims about the entity (typically the user) and any additional session metadata: 

{
  "sub": "1234567890",
  "name": "Jane Doe",
  "admin": true,
  "iat": 1773700000,
  "exp": 1773703600
}

3. The Signature

The signature is generated by hashing the Base64URL-encoded header and payload with a private secret key or public-private keypair: 

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secretKey
)

Standard Registered JWT Claims (RFC 7519)

Claim Key Formal Name Description & Format
iss Issuer Identifies the principal that issued the JWT (e.g. https://auth.company.com).
sub Subject Identifies the principal subject of the JWT (e.g., unique user UUID or ID).
aud Audience Identifies the intended recipients or backend APIs of the JWT.
exp Expiration Time Identifies the expiration timestamp (in seconds since UNIX Epoch).
nbf Not Before Identifies the time before which the JWT must not be accepted for processing.
iat Issued At Identifies the timestamp when the token was created.
jti JWT ID Provides a unique identifier for the token, preventing replay attacks.

Programmatic Client-Side Decoding

Here is how our client-side decoding function extracts claims without external dependencies:

function decodeJwtClientSide(tokenString) {
    const parts = tokenString.trim().split('.');
    if (parts.length !== 3) {
        throw new Error("Invalid JWT: Must consist of three dot-separated parts.");
    }

    const decodeBase64Url = (segment) => {
        let base64 = segment.replace(/-/g, '+').replace(/_/g, '/');
        while (base64.length % 4) base64 += '=';
        return JSON.parse(decodeURIComponent(escape(atob(base64))));
    };

    const header = decodeBase64Url(parts[0]);
    const payload = decodeBase64Url(parts[1]);

    return { header, payload };
}

Frequently Asked Questions

Why doesn't this tool verify the signature?
Verifying a JWT signature requires you to paste your private HMAC secret key or RSA private key into a browser form. Doing so is an extreme security hazard. We intentionally do not ask for secret keys to keep your credentials safe.
Can I modify the decoded payload and use it?
No. Any modification to a single character in the payload will invalidate the cryptographic signature attached to the token. Backend API servers will immediately reject modified tokens with a 401 Unauthorized status.
How do I convert the 'exp' timestamp to human time?
The 'exp' claim is an integer representing seconds elapsed since January 1, 1970 UTC. In JavaScript, you can convert it using: new Date(exp * 1000).toLocaleString().