Back to Utilities
ANALYZER
JWT Decoder
Decode JSON Web Tokens and inspect the header, payload claims and expiry — entirely in your browser, no data sent to any server.
Security notice: Never paste production JWTs or tokens containing sensitive data. This tool runs entirely in your browser — nothing is sent to any server.
Understanding JWTs
1
Header
Specifies the token type (JWT) and the signing algorithm (e.g. HS256, RS256). Always Base64url encoded.
2
Payload
Contains the claims — sub (subject), iss (issuer), exp (expiry), iat (issued at) and any custom data.
3
Signature
Cryptographic proof that the token was issued by the expected party and hasn't been tampered with.
Common standard claims
subSubject — who the token is about (user ID)
issIssuer — who issued the token (your auth service)
expExpiration — Unix timestamp when token expires
iatIssued at — Unix timestamp when token was created
nbfNot before — token is not valid before this time
audAudience — who the token is intended for