What is a JWT token and how does it work?

JWT (JSON Web Token) is a compact, URL-safe token format for securely transmitting information between parties. It consists of three Base64URL-encoded parts separated by dots: Header (algorithm and type), Payload (claims/data), and Signature (verification). JWTs are commonly used for authentication and API authorization.

How do I decode a JWT token online?

Paste your complete JWT token into the input field, and the decoder instantly displays the decoded header and payload as formatted JSON. You can view token claims, check expiration status, and copy individual parts. No secret key is needed for decoding.

Does this JWT decoder verify the signature?

No, this tool only decodes and displays JWT contents. Signature verification requires the secret key (for HS256) or public key (for RS256), which should never be shared publicly. Use this tool for inspection and debugging, not security validation.

Is it safe to paste my JWT token here?

Yes! All JWT decoding happens 100% in your browser using JavaScript. Your token never leaves your device or gets sent to any server. However, never share JWTs containing sensitive data publicly, as anyone can decode the payload.

What do the standard JWT claims mean?

Common registered claims include: iss (issuer - who created the token), sub (subject - who the token is about), aud (audience - intended recipient), exp (expiration time), nbf (not before - when token becomes valid), iat (issued at - creation time), and jti (JWT ID - unique identifier).

Why is my JWT token showing as expired?

The exp (expiration) claim contains a Unix timestamp in seconds. If the current time exceeds this timestamp, the token is expired. Check the decoded payload for the exp value and compare it to the current time. Expired tokens should be refreshed or re-authenticated.

What is the difference between HS256 and RS256 algorithms?

HS256 (HMAC-SHA256) uses a shared secret key for both signing and verification (symmetric). RS256 (RSA-SHA256) uses a private key for signing and public key for verification (asymmetric). RS256 is preferred for distributed systems where you don't want to share the signing key.

Can I edit or modify a JWT token?

You can view and copy the decoded payload, but editing the payload would invalidate the signature. JWTs are designed to be tamper-evident - any modification is detectable during signature verification. To change claims, you must create a new token with proper signing.

What is Base64URL encoding in JWTs?

Base64URL is a URL-safe variant of Base64 that replaces + with - and / with _ and removes padding (=). JWTs use Base64URL encoding for the header and payload to ensure tokens can be safely transmitted in URLs, headers, and cookies without encoding issues.

Why does my JWT have three parts separated by dots?

The three dot-separated parts are: 1) Header - contains algorithm (alg) and token type (typ), 2) Payload - contains claims and custom data, 3) Signature - cryptographic signature for verification. Format: header.payload.signature

What happens if the JWT is malformed or invalid?

The decoder shows specific error messages for: invalid Base64URL encoding, missing parts (must have exactly 3 dot-separated segments), invalid JSON in header or payload, or corrupted data. Check the error message to identify and fix the issue.

How do I check JWT expiration time in human-readable format?

This decoder automatically converts Unix timestamps in exp, nbf, and iat claims to human-readable dates. It also shows whether the token is currently valid, expired, or not yet valid, along with time remaining or time since expiration.

What are custom claims in JWT?

Beyond registered claims (iss, sub, exp, etc.), you can add custom claims for application-specific data like user roles, permissions, or preferences. Custom claims should use namespaced names to avoid collisions. Keep payloads small as JWTs are sent with every request.

How do I use JWTs for API authentication?

After login, the server issues a JWT containing user identity and permissions. Include the JWT in API requests via the Authorization header: "Bearer ". The server verifies the signature and extracts claims without database lookups, enabling stateless authentication.

What is the difference between JWT access tokens and refresh tokens?

Access tokens are short-lived JWTs (minutes to hours) used for API authorization. Refresh tokens are longer-lived tokens used to obtain new access tokens without re-authentication. This pattern balances security (short access token lifetime) with user experience (no frequent logins).

What is a JWT token and how does it work?

JWT (JSON Web Token) is a compact, URL-safe token format for securely transmitting information between parties. It consists of three Base64URL-encoded parts separated by dots: Header (algorithm and type), Payload (claims/data), and Signature (verification). JWTs are commonly used for authentication and API authorization.

How do I decode a JWT token online?

Paste your complete JWT token into the input field, and the decoder instantly displays the decoded header and payload as formatted JSON. You can view token claims, check expiration status, and copy individual parts. No secret key is needed for decoding.

Does this JWT decoder verify the signature?

No, this tool only decodes and displays JWT contents. Signature verification requires the secret key (for HS256) or public key (for RS256), which should never be shared publicly. Use this tool for inspection and debugging, not security validation.

Is it safe to paste my JWT token here?

Yes! All JWT decoding happens 100% in your browser using JavaScript. Your token never leaves your device or gets sent to any server. However, never share JWTs containing sensitive data publicly, as anyone can decode the payload.

What do the standard JWT claims mean?

Common registered claims include: iss (issuer - who created the token), sub (subject - who the token is about), aud (audience - intended recipient), exp (expiration time), nbf (not before - when token becomes valid), iat (issued at - creation time), and jti (JWT ID - unique identifier).

Why is my JWT token showing as expired?

The exp (expiration) claim contains a Unix timestamp in seconds. If the current time exceeds this timestamp, the token is expired. Check the decoded payload for the exp value and compare it to the current time. Expired tokens should be refreshed or re-authenticated.

What is the difference between HS256 and RS256 algorithms?

HS256 (HMAC-SHA256) uses a shared secret key for both signing and verification (symmetric). RS256 (RSA-SHA256) uses a private key for signing and public key for verification (asymmetric). RS256 is preferred for distributed systems where you don't want to share the signing key.

Can I edit or modify a JWT token?

You can view and copy the decoded payload, but editing the payload would invalidate the signature. JWTs are designed to be tamper-evident - any modification is detectable during signature verification. To change claims, you must create a new token with proper signing.

What is Base64URL encoding in JWTs?

Base64URL is a URL-safe variant of Base64 that replaces + with - and / with _ and removes padding (=). JWTs use Base64URL encoding for the header and payload to ensure tokens can be safely transmitted in URLs, headers, and cookies without encoding issues.

Why does my JWT have three parts separated by dots?

The three dot-separated parts are: 1) Header - contains algorithm (alg) and token type (typ), 2) Payload - contains claims and custom data, 3) Signature - cryptographic signature for verification. Format: header.payload.signature

What happens if the JWT is malformed or invalid?

The decoder shows specific error messages for: invalid Base64URL encoding, missing parts (must have exactly 3 dot-separated segments), invalid JSON in header or payload, or corrupted data. Check the error message to identify and fix the issue.

How do I check JWT expiration time in human-readable format?

This decoder automatically converts Unix timestamps in exp, nbf, and iat claims to human-readable dates. It also shows whether the token is currently valid, expired, or not yet valid, along with time remaining or time since expiration.

What are custom claims in JWT?

Beyond registered claims (iss, sub, exp, etc.), you can add custom claims for application-specific data like user roles, permissions, or preferences. Custom claims should use namespaced names to avoid collisions. Keep payloads small as JWTs are sent with every request.

How do I use JWTs for API authentication?

After login, the server issues a JWT containing user identity and permissions. Include the JWT in API requests via the Authorization header: "Bearer ". The server verifies the signature and extracts claims without database lookups, enabling stateless authentication.

What is the difference between JWT access tokens and refresh tokens?

Access tokens are short-lived JWTs (minutes to hours) used for API authorization. Refresh tokens are longer-lived tokens used to obtain new access tokens without re-authentication. This pattern balances security (short access token lifetime) with user experience (no frequent logins).

JWT Decoder

simple

Decode and inspect JWT tokens without verification. View header, payload, claims, and expiration status. Debug authentication tokens from OAuth, OpenID Connect, and API authorization systems.

Encoders & Decodersjwttokendecodejson web token

100% Private - Runs Locally

How to Use

1Paste your JWT token
2View decoded header and payload
3Check expiration status
4Copy individual parts

Examples

Decode HS256 Token

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Output

{"sub":"1234567890","name":"John Doe","iat":1516239022}

Token with Expiration

Input

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIiwiZXhwIjoxNzM1Njg5NjAwLCJpYXQiOjE3MDQxNTM2MDB9.signature

Output

{"sub":"user123","exp":1735689600,"iat":1704153600}

RS256 Token

Input

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtleTEifQ.eyJpc3MiOiJhdXRoLmV4YW1wbGUuY29tIiwiYXVkIjoiYXBpLmV4YW1wbGUuY29tIn0.signature

Output

{"iss":"auth.example.com","aud":"api.example.com"}

Frequently Asked Questions

Related Tools

View all

Base64 Encoder/Decoder

Encode and decode Base64 data instantly. Convert text, files, and images to Base64 format for embedding in HTML, CSS, JSON, and APIs. Supports URL-safe Base64 and handles Unicode characters.

HMAC Generator

Generate HMAC authentication codes with SHA-256, SHA-512, and other algorithms. Create keyed-hash message authentication codes for API authentication, JWT signing, and secure message verification.

JSON Formatter

Format, validate, and beautify JSON data instantly with syntax highlighting. Parse minified JSON, fix formatting issues, and visualize JSON structure with tree view for debugging APIs and config files.