JWT Decoder
Decode JSON Web Tokens (JWT) instantly. View header, payload, and signature parts without a secret key.
About this calculator
Paste a JSON Web Token and see its header and payload decoded, including claims such as sub, iat and exp. The signature is shown but not verified, since verification needs the secret or public key.
Decoding runs in your browser. Still, avoid pasting live production tokens into any website.
How to use it
- Paste the JWT.
- Read the decoded Header and Payload.
- Check the claims such as exp.
Structure of a JWT
A JWT is three Base64URL parts joined by dots: header.payload.signature. The header says how it is signed (alg, typ). The payload holds claims: sub (subject), iat (issued at), exp (expiry), iss (issuer) and aud (audience). Times are Unix seconds. The payload is only encoded, not encrypted, so anyone holding the token can read it.
Worked example
Sample token
| Header | {"alg":"HS256","typ":"JWT"} |
| Payload | {"sub":"1234567890","name":"John Doe","iat":1516239022} |
| iat 1516239022 | 18 January 2018, 01:30:22 UTC |
Tips and common mistakes
- Never put secrets in a JWT payload.
- Always verify the signature on the server.
- Check exp: expired tokens must be rejected.
- The alg 'none' is a known attack; reject it.
- Keep access-token lifetimes short.
Frequently asked questions
What is a JWT?
A compact token for passing signed claims between parties.
Is a JWT encrypted?
No, it is signed, not encrypted (unless it is a JWE).
What do iat and exp mean?
Issued-at and expiry times in Unix seconds.
Can this tool verify the signature?
No, that needs the secret or public key.
Is it safe to paste a token?
Decoding is local, but treat live tokens as secrets.
What are the three parts?
Header, payload and signature.