JWT Decoder
Inspect JWT headers and payloads instantly. Your token is processed entirely in your browser — it is never transmitted to a server.
Decoding ≠ Verification
Decoding a JWT reveals its contents but does not verify the signature. A decoded token should not be trusted as valid without server-side signature verification. Your token is processed entirely in your browser — it is never sent to a server.
Tip: Press Ctrl+Enter to decode.
What is a JWT?
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe means of representing claims to be transferred between two parties. A JWT consists of three Base64URL-encoded parts separated by dots:
- Header — specifies the token type (
JWT) and the signing algorithm (e.g.HS256,RS256). - Payload — contains the claims: registered ones like
sub(subject),iat(issued at),exp(expiry), and any custom application-specific claims. - Signature — produced by signing the header and payload with a secret or private key to prevent tampering.
Decoding ≠ Verifying
Decoding a JWT only reveals its contents. It does not confirm that the token is legitimate or untampered. Any application that trusts a JWT must verify the signature against the issuer's public key or shared secret. Never accept a decoded token as valid based on decoding alone.
Privacy
JWT payloads often contain sensitive information (user IDs, roles, email addresses). This tool processes the token entirely in your browser using JavaScript's atob() and JSON.parse(). No part of your token is sent to any server or logged anywhere.
Frequently Asked Questions
Can anyone decode a JWT without the secret key?
Yes. The header and payload are Base64URL-encoded JSON, not encrypted. Anyone who possesses the token can inspect its claims. The secret key is only required to verify the signature or generate new tokens.
What is the difference between decoding and verifying a JWT?
Decoding parses the Base64URL strings into readable JSON. Verifying cryptographically proves with a secret key (HMAC) or public key (RSA/ECDSA) that the token was issued by an authentic source and has not been tampered with.
How do I know if a JWT is expired?
Check the 'exp' (expiration time) claim in the payload. It represents Unix epoch seconds. If the current epoch time exceeds this value, the token is expired.
What is the difference between HS256 and RS256 algorithms?
HS256 uses a symmetric shared secret for both signing and verifying. RS256 uses an asymmetric key pair: the identity provider signs with a private key, and consuming services verify with the public key.
Should sensitive secrets or passwords be stored in a JWT payload?
No, never. Because JWT payloads are visible to anyone who inspects the token, sensitive data like passwords, credit cards, or internal API keys must never be placed inside claims.
Is my JWT token transmitted to a remote server?
No. All parsing and base64url decoding happens 100% locally inside your browser runtime. Zero tokens or claims ever leave your device.