JWT Decoder
Decode JSON Web Tokens, check expiry, spot risky claims and verify signatures locally.
Decoded entirely in your browser. The token is never sent anywhere, stored, or put in the URL.
How JSON Web Tokens work
A JWT is three base64url-encoded parts joined by dots: a header saying how it was signed, a payload of claims about the user or client, and a signature over the first two.
base64url(header) . base64url(payload) . base64url(signature)The payload is encoded, not encrypted. Anyone holding a token can read it, which is exactly what this decoder does. The signature is what stops tampering: change one character of the payload and verification fails.
Registered claims
iss(issuer) andaud(audience): who made the token and who it's for. Always check both.sub(subject): usually the user ID.exp,nbf,iat: expiry, not-before and issued-at times, in seconds since the Unix epoch.jti: a unique ID, useful for revocation lists and replay protection.
Signing algorithms
- HS256/384/512 (HMAC): one shared secret signs and verifies. Simple, but every verifier can also forge tokens.
- RS256, PS256 (RSA) and ES256 (ECDSA): a private key signs, and a public key verifies. Better when many services verify tokens.
- none: unsigned. Never accept it. Pin the algorithms your server allows instead of trusting the header.
Decoding isn't verifying
Never make an access decision from a decoded payload alone. Your server must verify the signature,
check exp/nbf (allowing a little clock skew), and validate iss and
aud. Keep secrets out of the payload, because it's readable by anyone. If a webhook
carries a JWT, you can explore the rest of its body with the
Webhook Payload Inspector.