JWT Decoder

Decode and inspect JSON Web Tokens instantly.

Enter JWT Token

What is a JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with HMAC algorithm) or a public/private key pair (using RSA or ECDSA).

JWT Structure

A JWT consists of three parts separated by dots (.), which are:

Header: Contains metadata about the token, such as the signing algorithm (alg) and token type (typ)
Payload: Contains the claims (statements about an entity and additional data)
Signature: Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way

Common JWT Claims

iss: Issuer - identifies the principal that issued the JWT
sub: Subject - identifies the principal that the JWT is about
aud: Audience - identifies the recipients that the JWT is intended for
exp: Expiration Time - identifies the expiration time on or after which the JWT must not be accepted
iat: Issued At - identifies the time at which the JWT was issued
nbf: Not Before - identifies the time before which the JWT must not be accepted

Security Considerations

Important: This tool only decodes JWTs. It does not verify signatures or validate tokens.

Always verify JWT signatures on the server side using the appropriate secret or public key
Never share your JWT secret keys or private keys publicly
Check token expiration (exp claim) before accepting tokens in production applications

JWT Decoder

Related Tools

CSS Minifier & Beautifier

Robots.txt Generator

Password Strength Checker

HTTP Status Code Lookup