What is a JWT Token?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. JWTs are widely used in modern web applications for authentication and information exchange, especially in OAuth 2.0 and OpenID Connect protocols.
When you log into a website or API, the server often issues a JWT that your browser or application stores and sends with subsequent requests to prove your identity. The token contains encoded information about the user and the session without requiring the server to maintain session state.
JWT Structure Explained
Every JWT consists of three parts separated by dots (.), each Base64URL-encoded:
Contains metadata about the token: the signing algorithm (alg) such as HS256 or RS256, and the token type (typ), typically "JWT".
Contains the claims — statements about the user and additional data. Common claims include sub (subject), exp (expiration), iat (issued at), and iss (issuer).
Created by signing the encoded header and payload with a secret key or private key. Used to verify the token has not been tampered with.
How to Decode JWT Tokens
Copy your JWT token from your browser DevTools, API response, or authentication system and paste it into the input box above.
The tool instantly decodes the token and displays the header, payload, and signature in formatted, readable JSON.
Check the expiration status, review claims like user ID and permissions, and copy any section with a single click.
Common JWT Claims
The JWT payload contains claims — key-value pairs that carry information. Here are the most commonly used registered claims:
- sub (Subject): Identifies the principal that is the subject of the JWT, typically a user ID.
- iss (Issuer): Identifies the principal that issued the JWT, such as your auth server.
- aud (Audience): Identifies the recipients that the JWT is intended for.
- exp (Expiration Time): The time after which the JWT must not be accepted. This tool automatically detects and displays this.
- iat (Issued At): The time at which the JWT was issued.
- nbf (Not Before): The time before which the JWT must not be accepted.
- jti (JWT ID): A unique identifier for the JWT, used to prevent token replay attacks.
JWT vs Session Tokens
Traditional session-based authentication stores session data on the server, while JWTs are self-contained tokens that carry all necessary information. Each approach has its strengths:
JWT Advantages
- Stateless — no server-side session storage needed.
- Scalable across multiple servers and microservices.
- Self-contained — carries user info in the token itself.
- Works well with SPAs and mobile applications.
Session Advantages
- Easy to revoke — just delete the session on the server.
- Smaller payload size (only a session ID).
- No sensitive data exposed to the client.
- Simpler implementation for traditional web apps.
Frequently Asked Questions
Is this JWT Decoder secure?
Yes, absolutely. This tool decodes your JWT entirely in your browser using JavaScript. Your token is never sent to any server, ensuring complete privacy and security for sensitive authentication tokens.
Can this tool verify JWT signatures?
This tool decodes and displays the JWT contents (header, payload, and signature) but does not verify the signature. Signature verification requires the secret key or public key used to sign the token, which should never be shared publicly.
What does the 'exp' claim mean?
The 'exp' (expiration time) claim identifies the expiration time on or after which the JWT must not be accepted for processing. This tool automatically detects the exp claim and shows whether your token is expired or still valid.
Why are there three parts in a JWT?
A JWT consists of three Base64URL-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims and data), and the Signature (verification hash). Together they form a compact, URL-safe token.
Can I decode any JWT token?
Yes, you can decode any valid JWT token regardless of the signing algorithm (HS256, RS256, ES256, etc.). The header and payload are simply Base64URL-encoded JSON and can always be decoded without the signing key.
Is a JWT the same as encryption?
No. Standard JWTs (JWS) are signed but not encrypted — anyone can decode and read the payload. If you need encrypted tokens, look into JWE (JSON Web Encryption). Never put sensitive secrets directly in a JWT payload.