JWT Decoder

Decode any JSON Web Token in your browser: header, payload and claims explained in plain words, expiry and not-before checks, warnings for unsigned or long-lived tokens, and local HS256 signature verification. Nothing is uploaded.

What a JSON Web Token is

A JWT is three Base64 blocks separated by dots: a header that names the signing algorithm, a payload with claims about the user or session, and a signature. The payload is not encrypted, only encoded, so anyone holding the token can read it. What the signature protects is integrity: a server that knows the key can tell whether the claims were altered.

This decoder shows both parts as formatted JSON, explains the standard claims, checks expiry against your clock and can verify HMAC signatures (HS256, HS384, HS512) with a secret you type in. Everything runs locally with the Web Crypto API.

Standard claims

iss issuer, who created the token. sub subject, usually the user ID. aud audience, the service the token is meant for.
exp expiry and nbf not-before, both Unix timestamps. iat issued-at. jti a unique token ID for revocation lists.
Everything else is application specific: roles, scopes, email, tenant IDs.

Things to watch for

alg: none means unsigned. A server that accepts it trusts anything.
HMAC algorithms share one secret between issuer and verifier. Short or guessable secrets can be brute-forced offline.
Tokens without exp never expire on their own.
Personal data in the payload is readable by every party that sees the token, including browser extensions and logs.