Private JSON Web Token decoder

JWT Decoder

Decode a JWT header and payload, inspect common claims, and translate numeric dates without implying signature verification.

Your token stays in your browser. Avoid pasting production tokens unless you understand their contents.

JWT

Header

Payload

Signature section

Common claims

What is a JSON Web Token?

A JSON Web Token, or JWT, is a compact string used to carry claims between systems. It normally contains a header, a payload, and a signature separated by periods. The header describes token metadata, while the payload contains application and registered claims.

Understanding common JWT claims

Claims such as iss, sub, and aud identify the issuer, subject, and intended audience. exp, nbf, and iat are numeric dates for expiration, not-before, and issued-at times. jti is an optional token identifier.

Decoding is not verification

JWT header and payload sections are encoded, not encrypted. Anyone holding a token can usually read them, and anyone can manufacture similar-looking content. Trust requires signature verification with an allowed algorithm and trusted key, followed by application-specific claim validation.

Handle tokens carefully

Tokens can contain usernames, internal identifiers, permissions, or other sensitive data, and bearer tokens may grant access while valid. This decoder stays local, but production tokens should still be handled as credentials.

Frequently Asked Questions

No. Decoding only reveals the token sections. Verification requires a trusted key, allowed algorithm, and application-specific claim checks.

No. Timestamp claims are shown as readable dates, but the tool never makes a validity or trust decision.

Usually not. Standard signed JWT header and payload sections are Base64URL-encoded and readable; encrypted JWTs use a different JWE structure.