JWT Decoder & Inspector
Decode and inspect JSON Web Token (JWT) headers, payloads, and expiration timestamps securely client-side in your browser.
Understanding JSON Web Token (JWT) Security & RFC 7519
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. JWTs are commonly used for stateless authentication and authorization in modern REST APIs, single-page applications (SPAs), and microservice architectures.
Anatomy of a JWT: The 3 Dot-Separated Parts
A JWT consists of three distinct parts separated by dots (.):
- Header (Red): Contains metadata about the token, such as the signing algorithm (e.g.
HS256orRS256) and token type (JWT). - Payload (Purple): Contains the token claims (user IDs, roles, scope permissions, and expiration timestamps).
- Signature (Blue): Cryptographic signature generated by combining the encoded header, encoded payload, and a secret key using the specified algorithm.
How to Use JWT Decoder & Inspector
- Paste your encoded JSON Web Token (e.g. eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...) into the token input field.
- The tool automatically unpacks the Header, Payload, and Signature sections in real-time.
- Inspect standard claims like sub, exp, iat, iss, and custom payload fields.
- Check token expiration status with human-readable timestamps.
Examples
Sample Decoded JWT Structure
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Ikx1Y2t5IFlhZHV2YW5zaGkiLCJpYXQiOjE1MTYyMzkwMjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Header: {"alg": "HS256", "typ": "JWT"}
Payload: {"sub": "1234567890", "name": "Lucky Yaduvanshi", "iat": 1516239022}
Frequently Asked Questions
Is my JWT authorization token sent to external servers?
No. Decoding happens 100% locally inside your web browser using JavaScript base64 URL decoding. Your JWT Bearer token is never transmitted over the network.
Can this tool verify the cryptographic signature of my JWT?
This tool decodes and displays the header and payload JSON claims. To cryptographically verify the signature, you must provide your server secret key or public RSA/ECDSA key in your backend auth server.
What are the standard claims in a JWT Payload?
Standard claims include `iss` (Issuer), `sub` (Subject), `aud` (Audience), `exp` (Expiration Time in UNIX epoch seconds), `nbf` (Not Before), `iat` (Issued At), and `jti` (JWT ID).
Related Developer Tools
JSON Formatter
Format, beautify, and validate JSON data instantly in your browser.
JWT Decoder
Decode and inspect JSON Web Token payloads securely client-side.
Regex Tester
Test regular expressions with real-time matching and syntax breakdown.