~/tools / jwt-decoder
// security

JWT Decoder

Paste a JSON Web Token (with or without the Bearer prefix) to read its header and claims. Decoding only — the signature is not verified.

● decoded in your browser — safe for real tokens

Claims

Header

Payload

Anatomy of a JWT

A JWT is three Base64URL strings joined by dots: header.payload.signature. The header names the signing algorithm (alg), the payload carries the claims, and the signature proves the first two were not tampered with. Header and payload are only encoded, not encrypted — anyone holding the token can read them, so never put secrets in a JWT.

Registered claims

  • iss issuer · sub subject · aud audience
  • exp expiry · nbf not before · iat issued at — all Unix timestamps in seconds
  • jti unique token id, used to prevent replay

Red flags this decoder points out

alg: none (unsigned token — reject it server-side), a missing exp (token valid forever) and tokens that are already expired or not yet valid.