JWT Decoder — Decode & Verify JWT Tokens
Decode JWT (JSON Web Tokens) online. View header, payload, and signature. Check expiry and all standard claims. 100% client-side.
Frequently Asked Questions
What is a JWT token?▾
A JWT (JSON Web Token) is a compact, URL-safe token used for securely transmitting information between parties. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. Example: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIn0.signature
What is a sample JWT token?▾
A sample JWT looks like: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c. The three parts are the header, payload, and signature.
Is it safe to decode a JWT token online?▾
Yes, on JSONDev.in it is completely safe. JWT decoding only base64-decodes the header and payload — it does not require the secret key. No data leaves your browser. However, never share tokens that are still valid and contain sensitive data publicly.
What claims are in a JWT payload?▾
Standard JWT claims include: sub (subject/user ID), iss (issuer), exp (expiration time as Unix timestamp), iat (issued at), aud (audience), nbf (not before), and jti (JWT ID). Your application can also add custom claims.
How do I check if a JWT is expired?▾
The JWT payload contains an exp claim with a Unix timestamp. This tool automatically shows whether the token is expired, how long ago it expired, or how long until it expires.
What is the difference between HS256 and RS256 in JWT?▾
HS256 uses a shared secret key for both signing and verification (symmetric). RS256 uses a private key for signing and a public key for verification (asymmetric). RS256 is preferred for systems where the verification party should not be able to create tokens.