JWT Decoder
Decode and inspect JSON Web Tokens. View header, payload, signature, and expiration status.
Decode and inspect JSON Web Tokens. View header, payload, and expiration status.
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022
}SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How do I use JWT Decoder?
Paste your `eyJ...` JSON Web Token into the input box or click 'Sample JWT' to load a realistic token.
Inspect the decoded JOSE Header (`alg`, `typ`, `kid`) and Payload claims (`sub`, `iat`, `exp`, `roles`) side by side.
Check the live Expiration Status badge to verify whether the `exp` timestamp is currently valid or expired.
What features does JWT Decoder offer?
Decode JWT header, payload, and signature
Token expiration status badge & human-readable timestamps
Formatted JSON payload tree viewer
100% private in-browser decoding — zero token transmission
RFC 7519 JSON Web Token Structure & Registered Claims
A compact JWT consists of three Base64URL-encoded segments separated by dots (`Header.Payload.Signature`). The header and payload are plaintext JSON—only the signature requires a cryptographic key.
| JWT Segment / Claim | JSON Key | Data Type | RFC 7519 Specification Purpose |
|---|---|---|---|
| JOSE Header | alg, typ, kid | Object | Declares signing algorithm (HS256, RS256, ES256) & key ID |
| Subject & Issuer | sub, iss, aud | String / Array | Identifies principal user ID, issuing auth server, and audience |
| Expiration Time | exp | NumericDate (Unix sec) | Unix epoch second after which the token MUST be rejected |
| Issued At / Not Before | iat, nbf | NumericDate (Unix sec) | Token issue timestamp and earliest valid activation time |
Frequently Asked Questions about JWT Decoder
Why can this tool decode my JWT payload without knowing my secret key?
A standard JWS token (`eyJ...`) is signed, not encrypted. The Header and Payload segments are simply Base64URL-encoded JSON strings (RFC 7519) so any client can read them. The secret or private key is only used to compute and verify the third segment (the Signature).
What is the difference between decoding a JWT and verifying a JWT signature?
Decoding Base64URL-parses the payload so you can inspect claims during debugging, but it does not prove the token wasn't tampered with. Backend servers must always verify the cryptographic signature (`HS256`, `RS256`, `ES256`) before trusting any claim.
What is the JWT `alg: none` vulnerability?
Early JWT libraries allowed attackers to change the header to `{"alg":"none"}` and strip the signature to bypass verification. Modern production verifiers explicitly whitelist expected algorithms (such as `RS256`) and reject `none`.
Is my production Bearer JWT transmitted over the network when I paste it here?
Never. Base64URL decoding and `exp` timestamp comparison execute 100% locally in your browser's JavaScript runtime—your session tokens never leave your tab.
Explore Related Developer Tools
HMAC Signature Generator
Generate and verify HMAC signatures (HMAC-SHA256, HMAC-SHA512) for Stripe, GitHub, Shopify, and Webhook verification.
Stripe Webhook Signature Verifier
Generate and verify Stripe Stripe-Signature (t=timestamp,v1=hex) HMAC-SHA256 webhook headers over ${timestamp}.${raw_body} in browser.
Shopify Webhook HMAC Verifier (Base64)
Compute and verify Base64-encoded X-Shopify-Hmac-Sha256 webhook signatures for Shopify orders/create and GDPR webhooks in browser.
URL Encoder / Decoder
Encode and decode URL strings with encodeURIComponent, encodeURI, and Base64URL modes.
GitHub Webhook Signature Tester
Compute and verify GitHub X-Hub-Signature-256 (sha256=<hex>) HMAC-SHA256 webhook headers for push and pull_request events.
Bcrypt & Argon2 Password Hash Generator & Verifier
Generate cryptographically secure Bcrypt password hashes ($2b$) with custom cost rounds, or test password verification.