JWT Decoder
Paste a JSON Web Token to see its header and payload as formatted JSON. Timestamps such as exp, iat and nbf are converted to readable dates, and expired tokens are flagged.
Structure of a JWT
A JWT has three parts separated by dots: header.payload.signature. The header and payload are JSON objects encoded with Base64URL without padding. The signature is computed over the first two parts with the algorithm named in the header (alg), for example HS256 or RS256.
Registered claims
| Claim | Meaning |
|---|---|
iss | Issuer |
sub | Subject (usually the user ID) |
aud | Audience |
exp | Expiration time (seconds since 1970) |
nbf | Not valid before |
iat | Issued at |
jti | Unique token ID |
Decode a JWT in JavaScript
const [h, p] = token.split('.');
const json = (s) => JSON.parse(new TextDecoder().decode(
Uint8Array.from(atob(s.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0))));
console.log(json(h), json(p)); Frequently asked questions
Is it safe to paste my JWT here?
Decoding happens entirely in your browser; nothing is sent to a server. Still, treat production tokens as secrets.
Does decoding verify the signature?
No. Anyone can decode a JWT because it is only Base64URL. Verification requires the secret or public key and must be done by your server.
Comments (0)
Questions, ideas or a bug in “JWT Decoder”? Leave a comment, rate the tool, or reply to others.
No comments yet. Be the first to share your feedback!