JWT Decoder & Encoder
Decode JWT tokens to inspect their structure or encode new tokens for testing. Support for multiple algorithms and custom claims.
About JWT
JSON Web Tokens (JWT) are an open standard (RFC 7519) for securely transmitting information between parties as a JSON object.
- Header: Contains the token type and signing algorithm
- Payload: Contains claims (statements about an entity)
- Signature: Ensures the token hasn't been altered
- iat: Issued at time (Unix timestamp)
- exp: Expiration time (Unix timestamp)
- sub: Subject (user ID)
- iss: Issuer
- aud: Audience
⚠️ Security Note: This tool only decodes JWTs, it does not verify signatures. Never paste sensitive tokens on untrusted websites.
Frequently Asked Questions
What is a JWT token and how is it structured?
JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and information exchange. It consists of three Base64-encoded parts separated by dots: Header (algorithm and token type), Payload (claims/data), and Signature (verification). JWTs are commonly used in OAuth, API authentication, and single sign-on systems for secure stateless authentication.
Does the JWT decoder verify the token signature?
No, this decoder only decodes and displays JWT contents without signature verification. It extracts the header and payload for inspection. For security in production applications, always verify JWT signatures server-side using the correct secret key or public key. Never trust decoded JWT data without proper signature verification on your backend.
What information is stored in JWT header and payload?
The Header typically contains "alg" (algorithm like HS256, RS256) and "typ" (token type, usually "JWT"). The Payload contains claims: registered claims (iss, exp, sub, aud), public claims (custom standardized claims), and private claims (custom application data). Common payload fields include user ID, roles, permissions, and expiration time.
How do I check if my JWT token has expired?
Decode the JWT and look for the "exp" (expiration) claim in the payload. This is a Unix timestamp indicating when the token expires. Compare it with the current time - if current time is greater than exp value, the token has expired. Most JWT libraries automatically validate expiration during token verification.
Can I use the JWT encoder to create production tokens?
No! Never generate JWTs client-side for production use. This encoder is for testing and learning only. Production JWTs must be generated server-side with proper secret management, signature algorithms, and security practices. Client-side generated tokens can be easily forged and compromise your application's security. Always use backend JWT libraries.
Is it safe to decode my JWT tokens on this website?
The decoder runs entirely in your browser - tokens are never sent to any server. However, avoid pasting production tokens containing sensitive data on any public website. Use this tool with test tokens or remove sensitive claims before decoding. For production debugging, use local JWT tools or your server's logging system.