JWT Decoder
Paste a JSON Web Token to see its header and payload — nothing leaves your browser.
Header
Payload
Claims
Standard registered JWT claims
| Claim | Meaning | Example |
|---|---|---|
iss | Issuer — who created the token | "https://auth.example.com" |
sub | Subject — who the token is about, usually a user ID | "1234567890" |
aud | Audience — who the token is intended for | "my-api" |
exp | Expiration time — a Unix timestamp after which the token is invalid | 1735689600 |
nbf | Not valid before — a Unix timestamp before which the token must be rejected | 1735686000 |
iat | Issued at — a Unix timestamp of when the token was created | 1735682400 |
jti | JWT ID — a unique identifier, often used to prevent replay | "a1b2c3d4" |
These claims are conventions from RFC 7519, not requirements — a token can omit any of them or add its own custom claims.
Why Use This Decoder?
- Header, payload and claims decoded instantly as you type
- Timestamps like
exp/iatshown as readable dates - Expired tokens are flagged automatically
- Verify HS256/384/512 signatures right in your browser
- Nothing is ever uploaded — decoding happens locally
Features & Supported Capabilities
- Decodes any standard 3-part JWT (header.payload.signature)
- Signature verification for HMAC algorithms via the Web Crypto API
- Clear message when an asymmetric algorithm (RS/ES/PS*) can't be verified without a public key
- Copy the full decoded header and payload in one click
- Works entirely offline once the page is loaded
About this JWT decoder and debugger
A JSON Web Token (JWT) carries a header, a payload of claims and a signature, all Base64URL-encoded. This free online JWT decoder splits a token apart and shows the header and payload as readable JSON, with a reference for standard claims such as iss, sub, aud and exp. You can also verify HS256, HS384 and HS512 signatures by supplying the secret.
Decoding happens entirely in your browser, so tokens are never sent to a server, which matters because a JWT can grant access. Decoding is not the same as verifying: only a correct signature check shows a token is genuine. Related tools: the Base64 / URL / HTML encoder and the JSON formatter.
Frequently Asked Questions
Everything you might want to know about the online JWT decoder.
HS256, HS384 and HS512 — the HMAC family, where
the same secret signs and verifies. Asymmetric algorithms like RS256 or
ES256 need the issuer's public key to verify, which this tool doesn't ask
for, so those show as unsupported rather than a false result.
exp claim is a Unix timestamp marking when the token stops being
valid. If that time is in the past compared to your device's clock, the row is
highlighted so it's obvious at a glance.