JWT Decoder
Paste a JWT token to decode its header and payload. No signature verification.
JWT Inspection Best Practices
Decoding a token helps you inspect claims quickly during auth debugging, but decoding alone does not prove authenticity.
- Review exp and nbf timestamps before testing protected routes.
- Check aud, iss, and sub values against expected environment settings.
- Treat decoded payload data as untrusted until signature verification succeeds.
About JSON Web Tokens
A JSON Web Token (JWT) is a compact, URL-safe representation of claims transferred between two parties. The claims are encoded as a JSON object that is digitally signed using a JSON Web Signature (JWS) or encrypted using a JSON Web Encryption (JWE). JWTs are commonly used for authentication and information exchange because their signature can be verified and their content trusted without a round trip to a database.
Header, Payload, and Signature
A JWT consists of three Base64URL-encoded sections separated by dots. The header specifies the token type and the signing algorithm, such as HMAC SHA-256 or RSA. The payload contains the claims, which are statements about the subject and additional metadata including expiration time and issuer. The signature is produced by encoding the header and payload and signing them with the algorithm declared in the header, allowing recipients to verify the token has not been tampered with.