JWT Decoder
Decode and analyze JWT tokens. View header, payload, and signature information for debugging and verification.
Paste a JWT token to decode it. Analysis happens in your browser - no data is sent to servers.
Header
-
Payload
-
Signature
-
Use Cases
Debug Authentication
Verify token claims and structure in auth systems
Inspect Headers
Check algorithm and token type information
Verify Expiration
Check token expiration times and validity
View User Data
Extract user information and claims from tokens
How to Use
- Paste a JWT token into the input field
- Click "Decode JWT" to parse the token or it decodes automatically
- View the decoded Header, Payload, and Signature components
- Copy or download the decoded JWT components
- Use for debugging API tokens, session tokens, and authentication tokens
How It Works
- JWT Format: Three Base64-encoded parts separated by dots (header.payload.signature)
- Header: Contains token type (JWT) and the hashing algorithm used (HS256, RS256, etc.)
- Payload: Contains claims (assertions about the entity) such as user ID, permissions, expiration time
- Signature: Created by encoding the header and payload with a secret key - proves the token hasn't been tampered with
- Claims: Statements about the user (iss: issuer, sub: subject, aud: audience, exp: expiration)
- Stateless: JWT doesn't require server-side session storage, making it ideal for REST APIs
- Verification: Always verify the signature on the server side using the secret key
- Security Note: Decoding happens entirely in your browser. No data is transmitted to any server.