JWT Decoder

JWT Decoder — decode JWT online

JSON Web Token (JWT) is a compact format for transferring claims between parties. A token consists of three Base64url-encoded parts separated by dots: Header, Payload, and Signature.

JWT Structure

• Header — token type and signing algorithm (alg, typ);
• Payload — claims: user data and metadata (iss, sub, exp, iat, etc.);
• Signature — HMAC or RSA/ECDSA signature for token verification.

Standard Claims (RFC 7519)

• iss — Issuer: who issued the token;
• sub — Subject: who the token was issued to;
• aud — Audience: intended recipient;
• exp — Expiration Time: token expiry (Unix timestamp);
• nbf — Not Before: token is not valid before this time;
• iat — Issued At: time the token was issued.

Frequently Asked Questions

• Can the JWT Decoder verify whether a token is valid?

  No, this tool does not verify the token signature and cannot confirm its authenticity. It only decodes the header and payload, showing the expiration time (exp) and other claims. Full token verification requires the secret key or the issuer's public key and must be done server-side.

• What should I do if the decoder shows an error when I paste a token?

  Make sure you copied the complete JWT including the signature (all three parts separated by dots). The token must be a valid Base64url-encoded string. If the error persists, the token may contain invalid characters or be corrupted. Try generating a fresh test token to confirm the issue.

• Does the decoder support encrypted JWT (JWE)?

  No, this tool is designed for signed JWT (JWS) only. If the token is encrypted (JWE), the decoder cannot decrypt the payload because a private key is required. In that case only the header will be visible, while the payload will appear as an opaque encrypted string.