What is a JWT?
A JSON Web Token is a compact string that carries signed information between a server and a client. You see them in login systems, API authentication and single sign-on flows.
A token is made of three parts separated by dots. The header names the signing algorithm, the payload holds the actual data or claims, and the signature proves the token has not been changed.
How to use this tool
- Paste your JWT into the editor.
- Click Decode token.
- Read the header and payload in readable JSON.
- Check the expiry notice to see if the token is still valid.
What the parts tell you
- Header: which algorithm signed the token, usually HS256 or RS256.
- Payload: claims such as the user id, name, issued-at time and expiry.
- Signature: the encoded proof of authenticity, not readable without the key.
Reading claims with confidence
Claims are the useful part. The iat claim shows when the token was issued, exp shows when it expires, and custom claims carry whatever your app stores. Decoding the token lets you inspect all of that in seconds.
Frequently Asked Questions
A JSON Web Token is a compact way to pass signed data between a server and a client. It has three parts separated by dots: a header, a payload, and a signature.
The header describes the signing algorithm, the payload holds claims like user id or expiry time, and the signature verifies that the token was not tampered with.
No. This decoder reads the content of the header and payload. Signature verification needs the secret key, which the token owner keeps private.
The tool runs entirely in your browser, so the token never leaves your device. Still, treat live tokens carefully and prefer decoding test tokens when possible.
exp is the expiry timestamp. The tool reads it and tells you whether the token is still valid or how long it has left. Not all tokens include one.
The first part is the header, the second is the payload, and the third is the signature. Each is Base64url-encoded, so decoding all three reveals the full token content.