JWT Decoder
1. Paste Encoded JWT
Load Sample
2. Decoded Token Data
How to Use the JWT Decoder
- Paste your JSON Web Token (JWT) into the text box.
- The tool automatically splits the token into three parts.
- Read the decoded Header and Payload sections.
- Review the signature status (if verification is enabled).
Formulas and Technical Logic
A JWT consists of three parts: Header, Payload, and Signature. They are separated by dots. The format is Header.Payload.Signature. The Header and Payload are Base64Url encoded. The tool decodes these Base64Url strings back into readable JSON format. It does not crack the signature.
Key Features
- Instant Base64Url decoding.
- Clear JSON formatting for Header and Payload.
- Identifies standard claims like ‘exp’ (expiration) and ‘iat’ (issued at).
- 100% client-side processing for security.
Reference Table: Standard JWT Claims
| Claim | Name | Description |
|---|---|---|
| iss | Issuer | Identifies the principal that issued the JWT. |
| exp | Expiration Time | Identifies the time on or after which the JWT must not be accepted. |
| sub | Subject | Identifies the principal that is the subject of the JWT. |
| aud | Audience | Identifies the recipients that the JWT is intended for. |
Frequently Asked Questions
Can this tool verify the JWT signature?
No, this tool only decodes the header and payload. You need the secret key to verify the signature.
Are JWTs encrypted?
Standard JWTs are encoded, not encrypted. Anyone can decode and read the payload. Do not store sensitive data in a JWT.