JWT Decoder

This JWT decoder reveals the content of a JWT token (split into 3 parts: header, payload, signature). Decoding is performed entirely in your browser, no data is sent to a server.

Need help with this tool ?

Paste your JWT token in the input field. Decoding is instant and performed entirely in your browser: no data is sent to a server, ensuring the confidentiality of your tokens.

I need a demo !

JWT Decoder

Paste your JWT token:

Decoding is performed entirely in your browser. No data is sent to a server.

JWT token structure

A JWT consists of three parts separated by dots (.):

                HEADER.PAYLOAD.SIGNATURE
            

1. Header

The header typically contains the token type (JWT) and the signing algorithm used (e.g., HMAC SHA256 or RSA).

{
  "alg": "HS256",
  "typ": "JWT"
}

2. Payload

The payload contains the claims — statements about the user and additional metadata.

{
  "sub": "1234567890",
  "name": "John",
  "iat": 1516239022
}

3. Signature

The signature is created by encoding the header and payload, then signing them with a secret key or a public/private key pair.

HMACSHA256(
  base64UrlEncode(header)
  + "."
  + base64UrlEncode(payload),
  secret
)

Standard payload claims

Claim	Full name	Description
`iss`	Issuer	The entity that issued the token
`sub`	Subject	The subject of the token (often the user ID)
`aud`	Audience	The intended recipient of the token
`exp`	Expiration Time	Token expiration date (UNIX timestamp)
`nbf`	Not Before	Date before which the token is not valid
`iat`	Issued At	Token creation date
`jti`	JWT ID	Unique token identifier

Claim

Full name

Description

iss

Issuer

The entity that issued the token

sub

Subject

The subject of the token (often the user ID)

aud

Audience

The intended recipient of the token

exp

Expiration Time

Token expiration date (UNIX timestamp)

nbf

Not Before

Date before which the token is not valid

iat

Issued At

Token creation date

jti

JWT ID

Unique token identifier

Common use cases

Authentication: After login, a JWT is returned to the user. Each subsequent request includes the JWT, granting access to authorized resources.

Information exchange: JWTs securely transmit information between parties, with the signature ensuring data integrity.

Authorization (OAuth 2.0): OAuth access tokens are often in JWT format.

Single Sign-On (SSO): JWTs simplify single sign-on across multiple applications.

Common signing algorithms

Algorithm	Type	Description
HS256	Symmetric	HMAC with SHA-256, the most common
HS384	Symmetric	HMAC with SHA-384
HS512	Symmetric	HMAC with SHA-512
RS256	Asymmetric	RSA with SHA-256
ES256	Asymmetric	ECDSA with P-256 curve

Algorithm

Type

Description

HS256

Symmetric

HMAC with SHA-256, the most common

HS384

Symmetric

HMAC with SHA-384

HS512

Symmetric

HMAC with SHA-512

RS256

Asymmetric

RSA with SHA-256

ES256

Asymmetric

ECDSA with P-256 curve

Security best practices

Never store sensitive data in the payload (passwords, API keys). The payload is simply Base64 encoded, not encrypted.

Always use HTTPS to transmit tokens.

Set a reasonable expiration (exp claim).

Always validate the signature server-side before using the token data.

Use strong algorithms (RS256 or ES256 in production).

Tip: This tool decodes JWTs entirely in your browser. No data is sent to a server, so you can safely use it with your production tokens.

I'm looking for a tool to...

Need help with this tool ?

What is a JWT token?

JWT token structure

1. Header

2. Payload

3. Signature

Standard payload claims

Common use cases

Common signing algorithms

Security best practices