$ jwt --decode

jwt parser.

Decode and inspect JSON Web Tokens. View header, payload, and validate expiration.

input token

decoded token

Paste a JWT and click parse to inspect its contents.

What is a JWT?

JSON Web Token (JWT) is a compact, URL-safe token format used for authentication. It consists of three parts: header, payload, and signature, separated by dots.

Can I see the signature?

The tool decodes the header and payload (which are Base64-encoded JSON). The signature is displayed but cannot be verified without the secret key.

Is my token sent to a server?

No, everything runs client-side in your browser. The token never leaves your computer.

JWT Structure

A JWT has three Base64URL-encoded parts separated by dots:

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.abc123signature
 |__________| |______________| |____________|
    Header        Payload         Signature

Common Header & Payload Claims

Claim	Location	Purpose
`alg`	Header	Signing algorithm (HS256, RS256)
`typ`	Header	Token type (always "JWT")
`sub`	Payload	Subject (user ID)
`iss`	Payload	Issuer (who created it)
`exp`	Payload	Expiration (Unix timestamp)
`iat`	Payload	Issued at (Unix timestamp)
`aud`	Payload	Audience (intended recipient)

Security warning: JWT payloads are only encoded, NOT encrypted. Anyone can decode the payload. Never put secrets (passwords, API keys) in a JWT — use jwe (encrypted JWT) for sensitive data.

learn more in our detailed guide.

→ read the guide