JWT decoder
Decode JSON Web Tokens and inspect header, payload claims, and expiry status
JWT Decoder
Decode and inspect JSON Web Tokens
TL;DR
What is JWT decoder?
A JSON Web Token (JWT) is a compact, URL-safe format for securely transmitting information between two parties as a signed JSON object. It is most commonly used for authentication: after a user logs in, the server issues a JWT that the client sends with every subsequent request to prove identity, without the server needing to store any session data.
How it works
A JWT consists of three Base64URL-encoded parts separated by dots: the header (signing algorithm and token type), the payload (claims such as user ID, roles, and expiry), and the signature (a cryptographic hash of the header and payload, signed with a secret or private key). The signature lets any party with the key verify that the token has not been tampered with.
Common use cases
- ‣API authentication: sent as a Bearer token in the Authorization header on every request
- ‣Single Sign-On (SSO): one token works across multiple services or subdomains
- ‣Stateless sessions: no server-side session storage needed; the token carries all required claims
- ‣Microservice authorization: services pass user context to each other without hitting a central auth database
Frequently asked questions
Is a JWT encrypted?
No. The payload is Base64URL-encoded, not encrypted. Anyone who holds the token can read its contents. Never store passwords, credit card numbers, or other sensitive data in a JWT payload. If you need the payload to be unreadable, use JWE (JSON Web Encryption) instead.
What does "exp" mean in the payload?
"exp" is the expiry claim. It is a Unix timestamp (seconds since 1970-01-01 UTC) after which the token must be rejected. This tool converts it to a human-readable date and flags tokens that have already expired.
Can I verify the JWT signature here?
This tool decodes the header and payload without verifying the signature, since verification requires the server's secret key or public certificate. To verify, use a server-side library such as jsonwebtoken for Node.js, PyJWT for Python, or java-jwt for Java.
What is the difference between HS256 and RS256?
HS256 uses a single shared secret for both signing and verification, suitable when the issuer and verifier are the same system. RS256 uses an RSA private key to sign and a public key to verify, making it better for distributed systems where multiple services need to verify tokens without sharing a secret.
See also
- ‣HMAC generator: HS256/HS512 JWT signing uses HMAC-SHA256/SHA512. Use the HMAC generator to reproduce a signature for testing and debugging
- ‣RSA key pair generator: RS256/RS512 JWT signing requires an RSA private key; generate a key pair here and use the public key for verification
- ‣Base64 string encoder: JWT header and payload are Base64URL-encoded JSON. Decode either segment independently to inspect the raw bytes