🪙

JWT Decoder

Decode and inspect JSON Web Token payloads

JWT Token

Related Tools

About This Calculator

JSON Web Tokens (JWTs) are compact, URL-safe tokens used for authentication and information exchange in modern web applications. A JWT consists of three Base64-encoded parts: header, payload, and signature. This decoder splits a JWT into its components and displays the decoded header (algorithm and token type), payload (claims like subject, issuer, expiration, and custom data), and signature. It also validates expiration timestamps and shows whether the token is currently valid or expired. Developers use this tool when debugging authentication flows, inspecting tokens from OAuth providers, verifying token contents during API development, and understanding what data their tokens carry.

How to Use

1
Paste a JWT
Enter your JSON Web Token string into the input field.
2
Inspect the payload
View the decoded header, payload claims, and expiration time.
3
Verify details
Check issuer, audience, and expiry claims to debug authentication issues.

Frequently Asked Questions

Q. Is it safe to decode a JWT in the browser?

Yes, decoding (reading) a JWT is safe because the header and payload are simply Base64-encoded, not encrypted. Anyone with the token can read its contents. Security comes from the signature, which verifies the token was not tampered with. Never put sensitive data like passwords in JWT payloads.

Q. What is the difference between HS256 and RS256?

HS256 (HMAC-SHA256) uses a shared secret key for both signing and verification — both parties must know the secret. RS256 (RSA-SHA256) uses a private key to sign and a public key to verify. RS256 is preferred when the verifier should not be able to create tokens, such as in distributed microservice architectures.

Q. How do I check if a JWT has expired?

The exp claim in the payload contains the expiration time as a Unix timestamp. Compare it to the current time. This tool automatically checks the exp claim and displays whether the token is currently valid or expired, along with the human-readable expiration date.

Disclaimer: Results are for informational purposes only and do not constitute professional advice. Always consult qualified professionals for important decisions.

Back to Developer Tools