JWT Decoder
Decode Base64URL JSON Web Tokens and inspect header, payload claims, and expiry dates.
🔒 Privacy Note: Tokens are decoded purely on the client-side inside your browser via JavaScript. No signature secrets or tokens are sent to any server.
Understanding JSON Web Tokens (JWT)
What is a JWT?
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. JWTs are commonly used for authorization headers in API authentication workflows (like OAuth 2.0 and OIDC).
How is a JWT Structured?
In its compact form, a JSON Web Token consists of three parts separated by dots (.):
header.payload.signature
Common Reserved Payload Claims
exp (Expiration Time)
Identifies the expiration time on or after which the JWT MUST NOT be accepted for processing (Unix Epoch Timestamp).
iat (Issued At)
Identifies the time at which the JWT was originally created and issued by the authorization server.
sub (Subject)
Identifies the principal/entity that is the subject of the JWT (such as a User ID or account ID).
Are JWT Tokens Encrypted?
No! Standard JWTs are signed, not encrypted. The Base64URL string can be trivially decoded by anyone with access to the token. Never store sensitive credentials, passwords, or unencrypted personal information inside a standard JWT payload.