Encoding
100% in your browser
JWT Decoder
Decode JSON Web Tokens instantly. Reveals the header, payload, and signature. Works offline — your token never leaves the browser.
⚠️ This tool does not verify the signature. Only use it to inspect token contents — never to validate authentication.
JWT Decoder
Paste any JSON Web Token to instantly decode its three parts: the header, the payload, and the signature. Expiry (exp) and issued-at (iat) timestamps are formatted as human-readable dates.
JWT structure
A JWT consists of three Base64URL-encoded parts separated by dots: header.payload.signature
- Header: specifies the token type (
typ) and signing algorithm (alg) — e.g. HS256, RS256. - Payload: contains the claims — user identity, roles, expiry, and any custom data.
- Signature: a cryptographic hash that verifies the token was not tampered with. This tool does not verify signatures.
Common JWT claims
sub— subject (user ID)iss— issueraud— audience (intended recipient)exp— expiration timestamp (Unix time)iat— issued-at timestampnbf— not-before timestampjti— JWT ID (unique identifier)
Security note
JWT payloads are only Base64-encoded — not encrypted. Never put sensitive information in a JWT unless you use JSON Web Encryption (JWE). Always verify signatures server-side.