JWT Decoder & Debugger

Decode JSON Web Tokens locally in real-time. Inspect claims, verify expiration timestamps, and analyze algorithm headers without transmitting secrets.

Sample Tokens:

Encoded Token (Base64URL):

Awaiting Token

Header: Algorithm & Token Type ALG: -

Payload: Data Claims & Expiration EXP: -

Verify Signature: Cryptographic Hash

Parsed Claims Breakdown:

Claim Key	Standard Meaning	Decoded Value
No claims parsed yet.

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) (RFC 7519) is a compact, URL-safe standard for transferring claim assertions between two parties. JWTs consist of three distinct parts separated by dots (.):

1. Header

Contains metadata specifying the signature algorithm (e.g., HS256, RS256) and token type.

2. Payload

Holds the claims (user identities, roles, permissions, issued timestamps, and expiration times).

3. Signature

Verifies that the sender is authentic and ensures the token contents were not tampered with.

Registered JWT Claims Glossary

Claim	Full Name	Description
`iss`	Issuer	Identifies the principal/authorization server that issued the token.
`sub`	Subject	Identifies the user or system principal represented by the token.
`aud`	Audience	Specifies the intended recipients or target API service.
`exp`	Expiration Time	Unix timestamp after which the token must be rejected.
`nbf`	Not Before	Unix timestamp specifying when the token becomes valid.
`iat`	Issued At	Unix timestamp recording when the token was generated.

Frequently Asked Questions (FAQ)

No. Standard JWS (JSON Web Signature) tokens are signed, not encrypted. Their payload values are merely Base64URL-encoded and can be read by anyone who holds the token string. Never store sensitive credentials (like database passwords or API keys) in a standard JWT payload.

No. All parsing, Base64URL decoding, and timestamp calculations execute strictly inside your browser environment using client-side JavaScript.

The exp claim uses standard NumericDate representation (seconds since January 1, 1970 UTC). The decoder converts this integer into your local system time zone to display human-readable expiration status.