How to use JWT Decoder
The JWT Decoder parses JSON Web Tokens and displays their header, payload claims and signature in a readable format. JWTs are Base64URL-encoded tokens used to securely transmit identity and authorisation claims between parties. This tool lets developers inspect token contents, check expiry times, verify algorithm choices and debug authentication flows without writing a single line of code.
- Paste the full JWT string (three dot-separated segments) into the input field.
- The tool automatically splits and Base64URL-decodes the header and payload sections.
- Inspect the header for the algorithm (alg) and key ID (kid) fields.
- Check the payload for standard claims: iss (issuer), sub (subject), aud (audience), exp (expiry), iat (issued at).
- Note any custom claims added by your identity provider.
- For signature verification, enter the signing secret (HMAC) or public key (RSA/EC) in the verification panel.
Your data never leaves your device — 100% private processing.
JWT structure and encoding
A JWT consists of three Base64URL-encoded segments separated by dots: the header, the payload and the signature. The header is a JSON object specifying the token type ("JWT") and signing algorithm ("HS256", "RS256", "ES256", etc.). The payload contains claims — JSON key-value pairs carrying identity or authorisation data. The signature is computed over header.payload using the chosen algorithm and a secret or private key, ensuring the token has not been tampered with since it was issued.
Common JWT claims and security considerations
RFC 7519 defines registered claims: iss (issuer), sub (subject), aud (intended audience), exp (expiration Unix timestamp), nbf (not before), iat (issued at) and jti (JWT ID for replay prevention). Always validate exp before trusting a token. Never store sensitive data in the payload — it is encoded, not encrypted, and is trivially readable by anyone who holds the token. For confidential data, use JSON Web Encryption (JWE). The "none" algorithm (no signature) is a known attack vector — reject it explicitly in your validation code.
| Claim | Full name | Type | Purpose |
|---|---|---|---|
| iss | Issuer | String/URI | Identifies who issued the token |
| sub | Subject | String/URI | Identifies the principal (user ID) |
| aud | Audience | String or array | Identifies intended recipients |
| exp | Expiration | NumericDate | Token must be rejected after this time |
| nbf | Not Before | NumericDate | Token must be rejected before this time |
| iat | Issued At | NumericDate | Time the token was issued |
| jti | JWT ID | String | Unique ID for replay prevention |
Worked examples
Decode a JWT
Inputs: header.payload.signature (3 dot-separated parts)
Result: header and payload shown as JSON; signature stays Base64URL
Read the algorithm
Inputs: header segment Base64URL-decoded
Result: {"alg":"HS256","typ":"JWT"}
Check expiry
Inputs: payload exp claim 1735689600
Result: expires 1 Jan 2025 00:00:00 UTC
JWT signing algorithm comparison
| Algorithm | Type | Keys | Best for |
|---|---|---|---|
| HS256 | Symmetric (HMAC-SHA256) | One shared secret signs and verifies | A single trusted issuer |
| RS256 | Asymmetric (RSA-SHA256) | Private key signs, public key verifies | Many verifiers (OpenID Connect) |
| ES256 | Asymmetric (ECDSA P-256) | Private key signs, public key verifies | Shorter keys, mobile/IoT |
Glossary
- JWT
- JSON Web Token — a compact, URL-safe token format defined by RFC 7519 for securely transmitting claims.
- Claim
- A key-value pair in a JWT payload asserting a fact about the subject or the token itself.
- Base64URL
- A variant of Base64 using - and _ instead of + and /, safe for use in URLs without percent-encoding.
- HMAC-SHA256
- A symmetric signature algorithm that uses a shared secret to sign and verify JWTs (HS256).
- RS256
- RSA Signature with SHA-256 — an asymmetric JWT algorithm using a private key to sign and a public key to verify.
Related reading
Frequently Asked Questions
Why use JWT Decoder?
- Decode and display the header, payload, and raw signature of a JWT in structured JSON
- Inspect exp, iss, and aud claims without writing any Base64 decoding code
- Identify the signing algorithm (HS256, RS256, ES256) from the token header alg field
- Verify a JWT signature against a shared secret or public key directly in the browser
Common use cases
- Debug an authentication failure by checking the exp claim of a token from a login response
- Inspect iss and aud claims in an ID token to trace an OAuth misconfiguration
- Decode a third-party API JWT to discover which custom claims it includes
- Verify your server issues tokens with the correct sub and roles payload fields
- Check whether a token uses the unsafe none algorithm before deploying a validation fix
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Developer Tools
Base64 Encoder & Decoder
Encode text or files to Base64, or decode Base64 strings back to text in seconds. Free, private, and fully in-browser now.
Hash Generator
Generate SHA-1, SHA-256, SHA-384, and SHA-512 hashes instantly in your browser. Free, private, and secure for quick checks.
JWT Generator (HS256/384/512)
Create and verify HS256, HS384, and HS512 JSON Web Tokens with claim presets, base64 secret support, and round-trip signature checks entirely in-browser.
HMAC Generator
Generate HMAC signatures with SHA-1, SHA-256, SHA-384, or SHA-512 and a secret key. Uses the Web Crypto API. Free and private.
JSON Formatter & Validator
Format, validate, and minify JSON instantly. Includes syntax highlighting, error detection, and a collapsible tree view — free, private, in-browser.
Regex Tester
Test and debug regular expressions online. See live matches, capture groups, and replace output. Free, private, instant.
Explore all Developer Tools.