FREE TOOL
JWT Decoder Online
100% local JSON Web Token parsing 鈥?secure, no server upload, instant Header and Payload inspection
100% local JSON Web Token parsing 鈥?secure, no server upload, instant Header and Payload inspection
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It consists of three parts: Header, Payload, and Signature, separated by dots. JWT is commonly used for authentication and information exchange.
API debugging: inspect JWT content returned by APIs. Frontend development: debug login state and token expiration. Backend development: verify generated tokens are correct. Security auditing: check for sensitive information in tokens. Learning: understand JWT structure and field meanings.
Paste your JWT token into the input box. The tool automatically decodes and displays the Header and Payload content. The info panel shows key details like expiration time, issued at time, issuer, and expiration status. Click "Copy" buttons to quickly copy JSON from each part.
A JWT has three parts separated by dots: 1) Header: contains algorithm and type info; 2) Payload: contains the actual data like user ID, expiration time, etc.; 3) Signature: used to verify the token hasn't been tampered with. The first two parts are Base64-encoded JSON.
The Header and Payload are just Base64-encoded, NOT encrypted 鈥?anyone can decode and read the content. JWT security comes from the signature, which verifies tampering but doesn't hide content. Never store sensitive information in JWTs.
These are standard JWT claims (Registered Claims): exp (Expiration Time) is when the token expires, iat (Issued At) is when it was created, iss (Issuer) is who issued it, sub (Subject) is the subject, aud (Audience) is the intended audience. All are in Unix timestamp format.
Currently, this tool only decodes the Header and Payload 鈥?it does not verify signatures. Signature verification requires a secret key or public key. For security reasons, signature verification should be done server-side. For verification, use specialized tools like jwt.io.
Decoding failures usually happen because: 1) Invalid token format, not three-part structure; 2) Base64 encoding issues; 3) Token is truncated or corrupted. Check that your input is complete and in standard JWT format (xxxxx.yyyyy.zzzzz).