A JSON Web Token (JWT) is a compact, URL-safe token format defined by RFC 7519. Every JWT consists of three Base64URL-encoded sections separated by dots: header.payload.signature. The header specifies the token type and signing algorithm. The payload contains claims — structured assertions about the token subject and any application-specific data. The signature is a cryptographic hash of the header and payload that allows servers to verify the token has not been tampered with.
The header typically contains two fields: alg (the signing algorithm, such as HS256 for HMAC-SHA256 or RS256 for RSA-SHA256) and typ (always JWT). The payload contains registered claims — standardized fields including sub (subject, usually a user ID), iat (issued at, a Unix timestamp), exp (expiration time), and nbf (not before) — plus any custom claims the application adds, such as roles, permissions, or feature flags.
JWTs are popular for API authentication because they are stateless: the server does not need to maintain a session database. The client stores the JWT (typically in an HTTP-only cookie or localStorage) and sends it with every request in the Authorization: Bearer [token] header. The server validates the signature using its secret or public key, reads the claims, and processes the request — no database lookup required.
After a successful login, an API returns a JWT. Paste it into the decoder above and the three sections are immediately visible. The decoded header reveals the algorithm and token type. The decoded payload reveals the claims the API embedded: a user ID in sub, the user's display name and role as custom claims, the timestamp the token was issued in iat, and the expiration timestamp in exp.
The iat and exp fields contain Unix timestamps — seconds since January 1, 1970 UTC. The decoder automatically converts these to human-readable dates and calculates whether the token is currently valid or has expired, and how long remains until expiry. This is immediately useful during API integration: you can confirm the token grants the expected role, check whether the expiration window matches your application's session requirements, and verify the issued-at time aligns with when the login occurred.
A developer integrating a third-party OAuth provider uses this tool to quickly inspect access tokens during development, without writing any decoding code. When the API starts returning 401 Unauthorized errors, decoding the token immediately reveals whether it has expired — saving time that would otherwise be spent adding debug logging to the application.
JWT payloads are encoded, not encrypted. Base64URL decoding is not a security measure — anyone who possesses the token can read the payload. Never include sensitive data (passwords, credit card numbers, social security numbers, or private personal identifiers) in a JWT payload. If the payload must be confidential, use JWE (JSON Web Encryption, RFC 7516) instead.
Algorithm confusion attacks are a real threat. An attacker might modify the header's alg field from RS256 (asymmetric RSA signing) to HS256 (symmetric HMAC) and forge a token using the server's public key as the HMAC secret. Server-side JWT libraries must always enforce the expected algorithm and never trust the algorithm declared in the token header alone.
Short expiration is a best practice. Access tokens should expire in 15 minutes to 1 hour. A stolen token is valid until it expires — a short window limits the damage. Pair short-lived access tokens with a longer-lived refresh token (stored securely, validated server-side) to maintain sessions without requiring frequent re-login. Never set exp years in the future for tokens that grant sensitive access.
This jwt decoder online tool decodes JSON Web Tokens directly in your browser. Paste any JWT starting with eyJ to see the decoded header, payload, and expiry status. Timestamps for iat, exp, and nbf are shown in human-readable format. Your token never leaves your device — zero outbound requests.
A JSON Web Token (JWT) is a compact, URL-safe token format for securely transmitting information between parties as a JSON object. A JWT consists of three Base64URL-encoded parts separated by dots: a Header (algorithm and token type), a Payload (claims/data), and a Signature. JWTs are widely used for authentication and authorization in web APIs.
A JWT has three parts separated by dots. Split the token on ".", then Base64URL-decode each part. The header and payload are JSON strings that can be parsed with JSON.parse(). The signature is raw binary data. This jwt decoder does exactly that — no library required. All decoding runs natively in your browser.
This jwt decoder is completely safe to use. Your token is decoded entirely in your browser using native JavaScript — it is never sent to any server. You can verify this by opening DevTools → Network tab while decoding: there are zero outbound requests. The tool performs only decoding, not verification.
Decoding a JWT simply reads the Base64URL-encoded data inside the token. Anyone can decode a JWT without the secret key. Verification checks the cryptographic signature to confirm that the token was issued by a trusted party and has not been tampered with. Verification requires the secret key or public key. This tool decodes only — it does not verify signatures.
The exp (expiration time) claim specifies the Unix timestamp after which the JWT must not be accepted. This jwt decoder automatically detects the exp claim and shows whether the token is currently valid or has expired, along with the human-readable expiration date and time remaining or time since expiry.