🔑 JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange. It consists of three parts separated by dots: Header (algorithm), Payload (claims/data), and Signature (verification). This tool decodes the header and payload — it does NOT verify the signature.

Understanding JSON Web Tokens

JSON Web Tokens (JWT) are an industry standard for securely transmitting information between parties as a compact, URL-safe token. They're widely used for authentication in modern web applications, APIs, and mobile apps. A JWT consists of three base64-encoded parts separated by dots.

JWT Structure

• Header — Contains the algorithm (e.g., HS256, RS256) and token type
• Payload — Contains claims (data) like user ID, email, roles, and expiration time
• Signature — Cryptographic signature to verify the token hasn't been tampered with

Common JWT Claims

• sub — Subject (usually user ID)
• iss — Issuer (who created the token)
• exp — Expiration time (Unix timestamp)
• iat — Issued at (when the token was created)
• aud — Audience (intended recipient)

Important Security Note

This tool decodes the header and payload of a JWT — it does NOT verify the signature. Decoding a JWT does not require a secret key (the payload is just base64-encoded, not encrypted). Never store sensitive data in JWT payloads as they can be decoded by anyone.

Related Tools