JWT Decoder
Paste a JSON Web Token to decode its header, payload and signature in real time. View registered claims and check expiration status.
JWT Structure
A JSON Web Token consists of three Base64URL-encoded parts separated by dots: a header (algorithm and type), a payload (claims and data) and a cryptographic signature.
Common Claims
Standard registered claims include iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at) and nbf (not before). Custom claims can hold any JSON data.
Security Note
JWTs are signed but not encrypted by default -- anyone can read the payload. Never store secrets in a JWT. This tool only decodes tokens locally in your browser; nothing is sent to a server.