What is a JSON Web Token?
A JSON Web Token (JWT) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: a header (algorithm and type), a payload (claims and data), and a signature. This tool decodes JWTs entirely in your browser so your tokens are never transmitted to any server.
The three parts of a JWT
A JSON Web Token has three parts separated by dots: the header, the payload, and the signature. The header and payload are Base64URL-encoded JSON, so anyone can decode and read them — they are not secret. The header names the signing algorithm (such as HS256 or RS256), while the payload carries the claims: statements about the user and the token, like who issued it and when it expires.
The third part, the signature, is what makes a token trustworthy. It is computed from the header, the payload, and a secret or private key. If even one character of the header or payload is changed, the signature no longer matches, and verification fails.
Decoding is not the same as verifying
Decoding a JWT simply reveals its contents — it does not prove the token is genuine. Because the payload is only Base64URL-encoded, never trust its claims until the signature has been verified against the key that signed it. This tool decodes tokens instantly in your browser and can verify HMAC signatures when you supply the secret.
Verifying tokens safely
Always validate the signature with the issuer's key before trusting any claim, and check the exp and aud claims so an expired token, or one meant for a different service, is rejected. Prefer short-lived access tokens paired with refresh tokens over long-lived ones, and never place passwords or secrets in the payload, since anyone can read it.
How to decode a JWT
- 1Paste the token. Paste your JWT into the input. The header and payload are decoded and displayed as formatted JSON immediately.
- 2Read the claims. Review the decoded payload — standard claims such as exp, iat, and sub tell you when the token expires and who it identifies.
- 3Verify the signature. Switch to Verify and enter the signing secret to confirm the token has not been tampered with.
Examples
A decoded payload
The middle segment of a token, Base64URL-decoded.
Input
eyJzdWIiOiIxMjM0NSIsIm5hbWUiOiJBZGEiLCJleHAiOjE5MDB9
Output
{
"sub": "12345",
"name": "Ada",
"exp": 1900000000
}Token structure
Three Base64URL parts joined by dots.
Input
header.payload.signature
Output
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NSJ9.Kx7...signature
Standard JWT claims
Registered claim names defined by RFC 7519.
| Claim | Meaning |
|---|---|
| iss | Issuer — who created the token |
| sub | Subject — who the token is about |
| aud | Audience — who the token is intended for |
| exp | Expiration time (Unix seconds) |
| nbf | Not before — valid only after this time |
| iat | Issued at (Unix seconds) |
| jti | JWT ID — a unique identifier for the token |
Frequently asked questions
Is a JWT encrypted?+
No. A standard signed JWT is encoded, not encrypted. The header and payload are only Base64URL-encoded, so anyone can read them. Never put secrets in a JWT payload unless you are using an encrypted JWE.
Is it safe to decode my token here?+
Yes. Decoding and verification run entirely in your browser. Your token and any secret you enter are never sent to a server.
What does the signature do?+
It proves the token was issued by someone holding the signing key and that the header and payload have not been altered. Changing any part of the token invalidates the signature.
What does the exp claim mean?+
exp is the expiration time as a Unix timestamp in seconds. After that moment the token should be rejected. iat records when it was issued.
What is the difference between HS256 and RS256?+
HS256 signs with a single shared secret using HMAC-SHA256. RS256 signs with an RSA private key and is verified with the matching public key, which is better when many parties need to verify but not issue tokens.
Can someone edit a JWT?+
They can change the readable header and payload, but without the signing key they cannot produce a valid signature, so a verifying server will reject the modified token.
Where should a browser store a JWT?+
Prefer an HttpOnly, Secure cookie so scripts cannot read the token, which limits exposure if your site has a cross-site scripting flaw. Storing tokens in localStorage is convenient but readable by any script on the page.