What is a JWT?
A JSON Web Token (JWT) is a compact, self-contained way to transmit information between two parties as a signed package. You’ll encounter JWTs constantly in modern web applications — they’re commonly used to prove that a user is logged in, to carry permissions, and to pass identity information between services.
A JWT has three parts separated by dots: a header (the token type and signing algorithm), a payload (the actual data, called claims), and a signature (used to verify the token hasn’t been tampered with). Each part is Base64Url-encoded, which is why JWTs look like long strings of random characters.
What Does This Tool Do?
This tool decodes a JWT and displays its header and payload in a readable, formatted JSON view. You can instantly see what claims the token contains — such as user ID, expiration time, issued-at time, and any custom data — without needing to write any code.
How to Use This Tool
- Paste your JWT into the input field.
- The decoded header and payload appear immediately below.
- Key claims like expiration (
exp) and issued-at (iat) are shown in a human-readable format.
Common Use Cases
- Debugging authentication: Inspect what’s inside an access token to understand why a request is being rejected.
- Checking expiration: Quickly see when a token expires without needing to decode it manually.
- Understanding claims: Review what user information or permissions a token carries.
- Learning JWT structure: A great tool for understanding how JWTs work.
Registered Claims Reference
The JWT specification (RFC 7519) defines a set of standard claims you’ll see in most tokens:
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created and signed the token (e.g., your auth server) |
sub | Subject | Who the token is about — usually the user ID |
aud | Audience | Who the token is intended for (an API or service) |
exp | Expiration | Unix timestamp after which the token is invalid |
nbf | Not Before | Token must not be accepted before this timestamp |
iat | Issued At | When the token was created |
jti | JWT ID | Unique identifier, useful to prevent replay |
Anything beyond these is a custom claim — application-specific data like email, roles, permissions, or tenant_id.
Common Signing Algorithms
The alg field in the header tells you how the signature was produced:
| Algorithm | Type | Key used to verify |
|---|---|---|
HS256 / HS384 / HS512 | HMAC (symmetric) | The same shared secret that signed it |
RS256 / RS384 / RS512 | RSA (asymmetric) | The issuer’s public key |
ES256 / ES384 / ES512 | ECDSA (asymmetric) | The issuer’s public key |
none | No signature | ⚠️ Nothing — reject these tokens; alg: none is a known attack vector |
Symmetric algorithms (HS*) mean anyone who can verify a token can also forge one, so they suit single-application setups. Asymmetric algorithms (RS*/ES*) let many services verify tokens while only the issuer can create them — the standard choice for OAuth and OpenID Connect providers.
Reading a Token: a Quick Checklist
- Is it expired? Compare
expwith the current time — an expired token is the most common cause of401 Unauthorizederrors. - Is the audience right? An
audmismatch means the token was issued for a different API. - Does it have the claims your code expects? Missing
rolesorscopeclaims explain most403 Forbiddenerrors. - Does the
algmatch what your server expects? A different algorithm than expected is a red flag.
Frequently Asked Questions
Can this tool verify a JWT's signature?
No. Signature verification requires the secret key or public key used to sign the token, which this tool doesn’t have. This tool only decodes and displays the token’s contents. Always verify signatures server-side.
Is it safe to paste my JWT here?
The decoding happens entirely in your browser — nothing is sent to a server. However, JWTs often contain sensitive information, so be cautious about pasting production tokens into any tool, including this one.
What is the exp claim?
exp is the expiration time — a Unix timestamp indicating when the token becomes invalid. This tool displays it in a human-readable date format alongside the raw value.
What's the difference between an access token and a refresh token?
An access token is short-lived (minutes to hours) and sent with every API request. A refresh token is long-lived, stored more securely, and used only to obtain new access tokens. Access tokens are usually JWTs you can decode here; refresh tokens are often opaque strings that can’t be decoded.
Why do JWTs start with eyJ?
eyJ is the Base64Url encoding of {" — the first two characters of a JSON object. Since both the header and payload are JSON, virtually every JWT starts with eyJ and has a second eyJ right after the first dot.
Is a JWT encrypted?
A standard signed JWT (JWS) is not encrypted — anyone can read its contents, as this tool demonstrates. The signature only guarantees integrity, not secrecy. Never put passwords or secrets in a JWT payload. (There is an encrypted variant, JWE, but it’s much less common.)