JWT Decoder & Inspector
Paste a JSON Web Token below to instantly decode and inspect its header, payload, and signature.
Decoded result will appear here...What you can inspect
Header, payload, signature, and common claims like `exp`, `iat`, and `aud`.
Private by design
Decoding runs entirely in your browser — your token is never sent to a server or stored anywhere.
How to Use the JWT Decoder
- Paste your full JWT token into the input field on the left.
- The decoder automatically splits the token into its three parts: header, payload, and signature.
- View the decoded JSON in the output panel on the right.
- Click Copy to copy the decoded result to your clipboard.
What is a JSON Web Token (JWT)?
A JSON Web Token (JWT) is a compact, URL-safe token format used to securely transmit information between parties as a JSON object. JWTs are commonly used for authentication and authorization in web applications and REST APIs.
A JWT consists of three Base64URL-encoded parts separated by dots (.):
- Header — specifies the token type (
JWT) and the signing algorithm (e.g.,HS256,RS256). - Payload — contains claims: data like user ID, roles, expiration time (
exp), issued-at time (iat), and custom fields. - Signature — used to verify the token hasn't been tampered with. It is computed by signing the encoded header and payload with a secret or private key.
Common JWT Payload Claims
sub— Subject: identifies the user or entity the token refers to.iss— Issuer: the server or service that created the token.exp— Expiration time: Unix timestamp after which the token is invalid.iat— Issued at: Unix timestamp when the token was created.aud— Audience: intended recipients of the token.roles/scope— Custom claims for authorization (not standardized).
Security Note
This decoder runs entirely in your browser — no token data is sent to any server. However, never paste production tokens containing sensitive data into any public online tool. Use this tool for debugging tokens in development environments only.