JWT Decoder
Decode and verify JSON Web Tokens. Inspect header and payload claims and check signatures.
Decoder
Valid JWT
Decoded JWT
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"admin": true,
"iat": 1516239022
}Claims
iat
Thu, 18 Jan 2018 01:30:22 GMT (2018-01-18T01:30:22.000Z)Unix time when the token was issued. 9 years ago.
sub
1234567890The principal the token is about (often a user ID).
admin
trueCustom claim.
name
John DoeCustom claim.
Signature
reGQzG3OKdoIMWLDKOZ4TICJit3EW69cQE72E2CfzRE
Verification key
Registered claims
iss (Issuer)Who issued the token.
sub (Subject)The principal the token is about (often a user ID).
aud (Audience)Intended recipients of the token.
exp (Expiration)Unix time after which the token must not be accepted.
nbf (Not Before)Unix time before which the token must not be accepted.
iat (Issued At)Unix time when the token was issued.
jti (JWT ID)Unique identifier for this token.
Security
Client-side onlyAll decoding, verification, and signing runs in your browser. Nothing is sent to a server.
Production tokensAvoid pasting real production JWTs or signing secrets into any online tool.
Payload dataJWT payloads are only Base64URL-encoded, not encrypted. Never store sensitive PII in claims.
ExpirationUse short-lived access tokens and refresh flows instead of long-lived JWTs.