JWT Decoder

A JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and information exchange between services. A JWT has three Base64url-encoded parts separated by dots: the header (algorithm and token type), the payload (claims — user ID, roles, expiry), and the signature. This tool decodes the header and payload, shows expiry status, and clearly notes that the signature is not verified — because signature verification requires the secret key.

What the claims mean

sub — subject (usually the user ID). iat — issued at (Unix timestamp). exp — expiry (Unix timestamp). aud — audience (the intended recipient service). iss — issuer (the authentication server). jti — JWT ID (unique identifier for this token, used for revocation). These are standard claims; applications add custom claims alongside them (roles, permissions, org IDs).

Using this tool safely

This tool runs entirely in your browser — pasting a JWT here does not expose it to any third party. That said, production JWTs from live systems contain real user identifiers and session data. If you are debugging a production system, prefer to copy the JWT into a local tool or this browser-only decoder rather than a server-side service. Treat long-lived JWTs (weeks or months of expiry) as secrets.

Remember: decoding a JWT does not mean trusting it. Any client can craft a JWT payload with any claims — only the signature, verified with the correct key, proves the token is authentic. Always verify signatures on the server before trusting JWT claims.