JWT Decoder

Decode your JSON Web Tokens (JWT) instantly with our secure and easy-to-use JWT Decoder. No data is stored or sent to a server—everything runs locally in your browser.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token used to securely transmit information between parties as a JSON object. It is widely used for authentication and authorization in web applications.

JWT Structure: Header, Payload, and Signature

A JWT is composed of three parts, separated by dots (.):
<header>.<payload>.<signature>

🔐 Header

The header typically consists of two parts: the type of token (JWT) and the signing algorithm being used, such as HS256 or RS256.

{
  "alg": "HS256",
  "typ": "JWT"
}

📦 Payload

The payload contains the claims. Claims are statements about an entity (typically, the user) and additional metadata. There are three types of claims: registered, public, and private.

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

✍️ Signature

The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn’t changed along the way. It is generated by combining the encoded header and payload, then signing it using a secret or a private key.

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret
)

Why Decode a JWT?

Decoding a JWT helps developers and users inspect the token's content, such as expiration time, user roles, or custom claims. It’s crucial for debugging authentication systems and understanding how JWTs are structured.