JSON Web Token (JWT) Decoder
Decode and inspect your JWT token claims. All translations happen inside your browser, so your security tokens are never shared.
{ }{ }How JSON Web Tokens Work
Three Dot-Separated Strings
A JWT consists of three parts separated by dots (`.`): the Header, the Payload, and the Signature. - The **Header** typically consists of the token type (JWT) and the signing algorithm (e.g. HMAC SHA256 or RSA). - The **Payload** contains the claims—statements about an entity (typically, the user) and additional metadata (expiration time `exp`, issue time `iat`). - The **Signature** is computed using the secret/public key to verify that the sender is who it claims to be.
Decoding vs. Verification
It is crucial to understand that decoding a JWT does **not** prove its authenticity. Base64URL encoding is merely a format translation—anyone can decode a token. Authentication requires verifying the signature using the private/public cryptographic key.
Experiencing an issue with JWT Decoder & Inspector?
Notice a bug, calculation error, or unexpected result? Let us know.