JWT Decoder
Decode any JWT token to see its header, payload, and signature. Stays in your browser — tokens are never sent anywhere.
What a JWT actually is
A JSON Web Token (JWT) is three Base64URL-encoded parts joined by dots: header.payload.signature. The header and payload are JSON objects that anyone can decode — they're not encrypted, just encoded. The signature proves the token wasn't tampered with, and verifying it requires the secret/key.
Common header fields
alg— algorithm: HS256 (HMAC-SHA256), RS256 (RSA-SHA256), ES256 (ECDSA), or none.typ— always "JWT".kid— key ID, when the verifier needs to know which key to use.
Common payload claims
iss— issuer (who created the token)sub— subject (who the token is about — usually a user ID)aud— audience (who the token is for)exp— expiration time (Unix timestamp)iat— issued at (Unix timestamp)nbf— not before (Unix timestamp — token invalid before this time)jti— JWT ID (unique identifier, prevents replay)
Security caveat
Anyone with a JWT can read its contents. Never put sensitive data in the payload — passwords, PII, secrets. The signature only proves authenticity, not confidentiality. If you need confidentiality, use JWE (JSON Web Encryption) instead.