JWT Decoder & Inspector
Decode any JSON Web Token (JWT) into its header, payload, and signature segments. All claims are explained in plain English, expiry status is shown live, and algorithm security is flagged. No signature verification — this tool only decodes the Base64-encoded segments. Never share or paste production secrets here.
▶ Raw JSON (header + payload)
| Claim | Full Name | Description |
|---|---|---|
| iss | Issuer | Who issued the token (e.g. auth server URL) |
| sub | Subject | Who the token is about (usually user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration | Unix timestamp when token expires |
| nbf | Not Before | Token not valid before this time |
| iat | Issued At | When the token was issued |
| jti | JWT ID | Unique identifier to prevent replay attacks |
Frequently Asked Questions
What is a JWT?
A JWT (JSON Web Token) is a Base64URL-encoded token used for authentication. It contains three parts: a header (algorithm), a payload (claims), and a signature.
Is a JWT payload encrypted?
No. The payload is Base64URL-encoded, not encrypted. Anyone with the JWT can decode and read it without any key. Never put passwords or SSNs in a JWT payload.
Does this tool verify the JWT signature?
The tool decodes and displays the payload without signature verification. To verify the signature you need the secret or public key used to sign the token.
What does the exp claim mean?
The exp claim is a Unix timestamp indicating when the token expires. The decoder shows this as a human-readable date and flags expired tokens.