JWT Decoder
Client-sideDecode JWT tokens instantly. Inspect header, payload, and expiry — entirely client-side.
Client-side only. This tool decodes the header and payload portions of a JWT. It does not verify the signature — signature verification requires the secret key and should be done server-side.
What is a JWT?
A JSON Web Token (JWT) is a compact, self-contained token format for securely transmitting information as a signed JSON object. JWTs are widely used in authentication systems — when a user logs in, the server returns a JWT which the client sends with subsequent requests to prove identity.
A JWT has three parts separated by dots: the header (algorithm and token type), the payload (claims/data), and the signature (used to verify the token has not been tampered with).
Understanding JWT Structure
Header
Contains the algorithm used to sign the token (e.g., HS256, RS256) and the token type (typically "JWT").
Payload
Contains the claims — data encoded in the token such as user ID, roles, expiration time (exp), issued-at (iat), and custom claims.
Signature
The cryptographic signature that verifies the token has not been modified. Verification requires the secret key — this tool does not verify signatures.