Developer tool
JWT decoder
Paste a JSON Web Token to see what's inside: who it's for, what it allows, and when it expires.
Advertisement
Header
Payload
Times and claims
Check the signature (HS256 / HS384 / HS512)
Enter the secret to check an HS token. RS and ES tokens need a public key and aren't checked here.
Advertisement
What's inside a JWT
A JWT has three parts separated by dots: a header (which algorithm signed it), a payload (the claims, like the user ID and expiry), and a signature. The header and payload are only Base64URL-encoded, not encrypted, so anyone holding the token can read them.
| Claim | Meaning |
|---|---|
| iss | Who issued the token |
| sub | Who the token is about (usually a user ID) |
| aud | Who the token is meant for |
| exp | Expiry time (seconds since 1 Jan 1970) |
| nbf | Not valid before this time |
| iat | When the token was issued |
Is it safe to paste a real token here?
The token is decoded in your browser and never sent anywhere. Still, a live token works like a password until it expires, so avoid sharing it.
Does decoding prove the token is genuine?
No. Only checking the signature does. Your server must always verify the signature before trusting the payload.
Advertisement