JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: a header (algorithm and type), a payload (claims/data), and a signature.

Yes. This tool runs entirely in your browser — no token data is ever sent to a server. The decoding happens locally using JavaScript. However, never share your tokens publicly as they may contain sensitive information.

This tool decodes and displays the token contents but does not verify signatures. Signature verification requires the secret key or public key used to sign the token, which should never be shared in a browser tool.

Claims are statements about the user or token metadata stored in the payload. Standard claims include 'iss' (issuer), 'sub' (subject), 'exp' (expiration), 'iat' (issued at), and 'aud' (audience). Custom claims can store any data.

The payload's 'exp' claim contains the expiration time as a Unix timestamp. This tool automatically converts it to a human-readable date and shows whether the token is still active or has expired.

JWS (JSON Web Signature) tokens are signed but not encrypted — the payload is Base64-encoded and readable. JWE (JSON Web Encryption) tokens are encrypted, hiding the payload contents. Most JWTs you encounter are JWS tokens.