Dev Utilities LogoDev Utilities

JWT Decoder

Decode and validate JSON Web Tokens (JWT) instantly. Inspect header, payload, claims, and signature.

All operations run entirely in your browser. Your token never leaves your device.

Awaiting JWT Token

Paste a valid JSON Web Token on the left editor or load our interactive sample to inspect the decrypted header, payload, and expiration claims.

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

Structure of a JWT Token

In its compact form, a JSON Web Token consists of three parts separated by dots (.):

  • Header: Typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.
  • Payload: Contains the claims. Claims are statements about an entity (typically, the user) and additional metadata (like expiration or issue dates).
  • Signature: Used to verify the token hash and ensure that the message wasn't changed along the way.

Frequently Asked Questions

Is my JWT data secure with this decoder?

Absolutely. All decoding and parsing process runs exclusively on your browser using JavaScript. No tokens, secrets, or decrypted payloads are ever sent to any remote servers or saved databases. You can even use this page fully offline.

Why is verifying JWT expiration dates important?

JWTs usually contain an expiration claim (exp). Once this timestamp is reached, authentication filters should reject the token. Visualizing expiration and issue timestamps helps developers debug session lifetimes, token refresh cycles, and synchronization issues between servers.

What algorithms does this tool support?

Since we decode the JSON payload structurally, we support any JWT regardless of the algorithm (e.g. HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512). The claims decoding will succeed for all well-formed tokens.