Encoders
JWT Decoder
Need to decode or inspect JSON Web Tokens? Our free online JWT decoder lets you instantly view headers, payloads, and signatures for debugging and security audits.
JWT Token
Decoded JSON
Need to decode or inspect JSON Web Tokens? Our free online JWT decoder lets you instantly view headers, payloads, and signatures for debugging and security audits.
Search for a command to run...
Tip
Never put passwords or sensitive API keys in a JWT payload; they are easily decoded by anyone.
Did You Know?
JWT payloads are Base64Url encoded, which is a slightly modified version of standard Base64.
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA. They are most commonly used for authorization and information exchange in modern web applications.
Best Practice
Always validate the 'alg' header on your server to prevent 'none' algorithm security attacks.
Integrating JWT inspection into your workflow is essential for modern web development. When building Single Page Applications (SPAs), use this tool to verify the exp (expiration) and iat (issued at) claims during the login process. It is also invaluable for back-end developers to ensure that authentication middleware is receiving and parsing the correct sub (subject) or custom roles from the authorization header.
Q: Is it safe to use this JWT decoder? A: Yes, the decoding is performed entirely in your browser using JavaScript. Your token data never leaves your local machine.
Q: Why can't I see the secret key? A: A JWT only contains the signature hash, not the secret key itself. You can decode the payload, but you cannot retrieve the secret used to sign it.
Q: What does the 'exp' claim mean? A: The 'exp' claim identifies the expiration time on or after which the JWT must not be accepted for processing.
Q: Can I edit the token and re-encode it? A: While you can see the contents, any change to the payload requires a new signature with the original secret key to remain valid.