How this JWT decoder works
A JSON Web Token is a single string made of three sections joined by dots: header.payload.signature. The first two sections are JSON objects that have been base64url encoded — a URL-safe variant of base64 that uses - and _ instead of + and / and usually drops the trailing = padding.
To decode a token, this tool splits it on the dots, restores the standard base64 characters and padding, decodes each section back to bytes, interprets those bytes as UTF-8 text, and parses the result as JSON. The header and payload are pretty-printed in their own boxes. The signature is shown raw because it is binary data that cannot be turned into readable JSON, and because verifying it requires the signing secret or key, which this tool never has.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.signature splits into three parts. Base64url-decoding the first gives the header {"alg":"HS256","typ":"JWT"}; decoding the second gives the payload {"sub":"1234567890","name":"Jane Doe","iat":1516239022}. The iat value 1516239022 is a Unix timestamp in seconds — 18 Jan 2018 — which this tool converts to a readable date.Common JWT claims
The payload carries claims. A handful of short, three-letter names are registered in the standard and have agreed meanings:
| Claim | Name | Meaning |
|---|---|---|
| iss | Issuer | Who created and signed the token, e.g. an authorization server's URL. |
| sub | Subject | The principal the token is about — usually a user or account ID. |
| aud | Audience | The recipient(s) the token is intended for; a service should reject tokens not addressed to it. |
| exp | Expiration | Unix time (seconds) after which the token must be rejected. |
| iat | Issued At | Unix time (seconds) when the token was issued. |
| nbf | Not Before | Unix time (seconds) before which the token must not be accepted. |
Reference note: time claims are seconds since the Unix epoch (1 January 1970 UTC). This tool converts them using your device's local time zone and compares exp against the current time to flag expired tokens. It never verifies the signature.
Frequently asked questions
- What is a JWT?
- A JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties. It is widely used for authentication, carrying information such as who the user is and when the token expires in a single string that can be sent in an HTTP header.
- What are the three parts of a JWT?
- A JWT has three base64url-encoded parts separated by dots: the header, the payload and the signature, written as
header.payload.signature. The header names the algorithm, the payload holds the claims, and the signature lets a server check the token was not tampered with. - Is a JWT encrypted?
- No — a standard signed JWT is only base64url encoded, which is reversible. The header and payload are readable by anyone who has the token. The signature proves integrity, not secrecy, so never put sensitive data in the payload.
- How do I decode a JWT?
- Split the token on the dots, then base64url-decode the first part for the header and the second part for the payload. This tool does it automatically as you type, decoding entirely in your browser without uploading the token.
- What do iat/exp/sub mean?
iatis the issued-at time,expis the expiration time (both Unix timestamps in seconds), andsubis the subject — the principal the token is about, often a user ID. This tool converts the time claims to readable dates.- Does this verify the signature?
- No — this is a decode-only tool. It reads the header and payload but does not check the signature, so it cannot prove a token is authentic. Always verify the signature on the server using the secret or public key.