JWT Decoder
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "Aldo Marcelino",
"email": "aldo@example.com",
"role": "admin",
"iat": 1516239022,
"exp": 1987239022
}| Claim | Value | Description |
|---|---|---|
| sub | 1234567890 | Subject: Identifies the principal that is the subject of the JWT |
| name | Aldo Marcelino | Full Name of the user |
| aldo@example.com | Email address of the user | |
| role | admin | User authorization role |
| iat | 1516239022 Thu, 18 Jan 2018 01:30:22 GMT (3211 days ago) | Issued At: Timestamp when the JWT was created |
| exp | 1987239022 Tue, 21 Dec 2032 10:50:22 GMT (in 2240 days) | Expiration Time: Timestamp after which the JWT MUST NOT be accepted |
Understanding JSON Web Tokens
JSON Web Tokens are an open, industry-standard (RFC 7519) method for representing claims securely between two parties. Tokens are divided into three parts separated by dots:
- Header: Contains token type and signing algorithm (e.g. HS256, RS256).
- Payload: Contains claims (user IDs, roles, expiration timestamps).
- Signature: Verifies that the sender of the JWT is who it says it is and ensures content hasn't changed.
100% Client-Side PrivacyJWTs often contain sensitive authorization scopes and user IDs. Our decoder operates completely inside your browser. No tokens are sent over the network.
Base64Url Encoding vs EncryptionJWTs are digitally signed and Base64Url encoded, but NOT encrypted by default (unless using JWE). Never store unencrypted secrets or passwords in the payload.
How to use JWT Decoder
- Paste a JWT whose claims you want to inspect.
- Review the decoded header, payload, and any expiration information.
- Validate signatures and authorization separately in your own authentication system.
Try an example
Inspect whether a test token contains an exp claim and the expected audience.
Readable token claims. A decoded token can still be forged, expired, or issued for a different application.
What to know before using JWT Decoder
Paste a JSON Web Token to read its header and payload. A readable token is not a verified token: signature validation must happen in your authentication system.