Advertisement
Guide
About the JWT Decoder
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties — most commonly used for authentication and authorization. A JWT is made of three Base64URL-encoded parts separated by dots: the header (which algorithm signed it), the payload (the claims — who the user is, when the token expires, and so on), and the signature (which proves the token hasn't been tampered with).
This decoder splits a token into those three parts and shows the header and payload as readable JSON, flags standard claims, and tells you whether the token has expired. Decoding does not require the secret key — because the header and payload aren't encrypted, only signed.
Decoding is not the same as verifying
Anyone can read a JWT's contents — that's by design. What they can't do without the secret (or private key) is forgeone, because they can't reproduce a valid signature. This tool decodes and inspects; it does not verify the signature, since that requires your secret. The practical takeaway: never put sensitive data like passwords in a JWT payload, because it's effectively public to anyone holding the token.
Common claims you will see
iss— issuer, who created the token.sub— subject, usually the user ID.aud— audience, who the token is intended for.exp— expiry time (Unix seconds); past this, the token is invalid.iat— issued-at time; when the token was created.nbf— not-before; the token is invalid until this time.
How to use it
- 1Paste your JWT (the long dotted string) into the input.
- 2Read the decoded header to see the signing algorithm (e.g. HS256, RS256).
- 3Review the payload claims and check the expiry status.
- 4Use the JWT Builder if you need to create or re-sign a token.
Frequently asked questions
Do I need the secret key to decode a JWT?
No. The header and payload are only Base64URL-encoded, not encrypted, so they can be read without any key. The secret is only needed to verify or create the signature.
Is it safe to paste my token here?
The decoding happens entirely in your browser — the token is never sent to a server. That said, treat live production tokens carefully, since a valid token grants access until it expires.
Why does my token say it is expired?
The exp claim is a Unix timestamp. If the current time is past that value, the token is expired and most servers will reject it. You will need to obtain a fresh token.
What is the difference between HS256 and RS256?
HS256 uses a single shared secret for both signing and verifying (symmetric). RS256 uses a private key to sign and a public key to verify (asymmetric), which is better when many parties need to verify but only one should be able to sign.
Can I edit the payload and re-sign the token?
Not with the decoder — it is read-only. Use the JWT Builder tool to create a new token with your own payload and secret.