JWT Decoder — Free Online JSON Web Token Decoder
Decode JWT tokens instantly — inspect header, payload claims, expiration, and issuer without any server calls.
Frequently Asked Questions
Understanding JSON Web Tokens
JSON Web Tokens (JWT) are the de facto standard for stateless authentication in modern web applications. After a user logs in, the server issues a JWT that the client includes in the Authorization header of subsequent requests (Authorization: Bearer <token>).
A JWT has three parts separated by dots. The header specifies the token type (JWT) and the signing algorithm (e.g., HS256 for HMAC-SHA256 or RS256 for RSA). The payloadcontains claims — registered claims like sub (subject), exp (expiration),iat (issued at), and custom claims like roles or email. The signatureis computed from the header and payload using the server's secret or private key.
The payload is only Base64URL-encoded — not encrypted. Anyone who obtains a JWT can decode and read its claims. Never put passwords or sensitive PII in JWT payloads. The signature ensures the token wasn't tampered with, but the content is readable.