JWT Decoder
Decode and inspect JWT tokens — header, payload, and signature. No data leaves your browser.
Header + PayloadClaim InspectorExpiry CheckClient-Side Only
Standard JWT Claims Reference
| Claim | Name | Description |
|---|---|---|
| iss | Issuer | Who issued the token — typically the authentication server URL. |
| sub | Subject | Who the token is about — usually a user ID or email. |
| aud | Audience | Who the token is intended for — the API or client that should accept it. |
| exp | Expiration | Unix timestamp after which the token must not be accepted. |
| nbf | Not Before | Unix timestamp before which the token must not be accepted. |
| iat | Issued At | Unix timestamp when the token was issued. |
| jti | JWT ID | A unique identifier for the token — used to prevent replay attacks. |
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token format defined by RFC 7519. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature.
The header contains the token type and signing algorithm (e.g. HS256 or RS256). The payload contains claims — assertions about the user or session. The signature verifies the token was issued by a trusted party and has not been tampered with.
This decoder reads the header and payload without verifying the signature — it is for inspection and debugging only. Never trust a JWT claim without server-side signature verification.