What Is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties — most commonly used for authentication and authorization in web APIs. A JWT has three Base64URL-encoded parts separated by periods: header, payload, and signature.

The Three Parts

The header and payload are just Base64URL-encoded JSON — anyone can decode and read them without any secret key, which is exactly what this tool does. The signature, however, requires the secret (or private key) to verify, and can't be checked by a simple client-side decoder.

How to Use This Decoder

Paste your full JWT (all three parts, separated by periods) into the box. The decoder splits it, Base64URL-decodes the header and payload, and displays both as readable JSON. If the payload contains an "exp" (expiration) claim, it also shows whether the token is currently valid or expired.

Decoding Is Not Verifying

This is the single most important thing to understand about JWTs: anyone can decode and read a token's contents without any special access, because the header and payload are just encoded, not encrypted. Decoding tells you what a token claims; verifying tells you whether you can trust that claim. Only a server with the correct secret key (or public key, for asymmetric algorithms) can actually verify a token's signature is valid.

Common JWT Claims

• sub: the subject — typically a user ID
• iat: issued-at timestamp
• exp: expiration timestamp — when the token stops being valid
• iss: issuer — who created the token
• aud: audience — who the token is intended for

Common Algorithms in the Header

The header's "alg" field tells you how the token is signed — HS256 (HMAC with SHA-256) is common for simpler setups using a shared secret, while RS256 (RSA with SHA-256) is common when a public/private key pair is used, often for verifying tokens across multiple services without sharing a secret.

Where This Fits

Pair this with our Base64 encoder for general encoding tasks, and our JSON formatter if you need to clean up the decoded payload further.

Frequently Asked Questions