JWT Decoder
Encoded Token (Paste Header.Payload.Signature)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsZG8gTWFyY2VsaW5vIiwiZW1haWwiOiJhbGRvQGV4YW1wbGUuY29tIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5ODcyMzkwMjJ9.4zC4m_k4uQ0xP1E7N3bH0bL1nK8vC3tF6sE9wA2zL5Y
Header (Algorithm & Type)
{
"alg": "HS256",
"typ": "JWT"
}Payload (Data & Claims)
{
"sub": "1234567890",
"name": "Aldo Marcelino",
"email": "aldo@example.com",
"role": "admin",
"iat": 1516239022,
"exp": 1987239022
}| Claim | Value | Description |
|---|---|---|
| sub | 1234567890 | Subject: Identifies the principal that is the subject of the JWT |
| name | Aldo Marcelino | Full Name of the user |
| aldo@example.com | Email address of the user | |
| role | admin | User authorization role |
| iat | 1516239022 Thu, 18 Jan 2018 01:30:22 GMT (3210 days ago) | Issued At: Timestamp when the JWT was created |
| exp | 1987239022 Tue, 21 Dec 2032 10:50:22 GMT (in 2240 days) | Expiration Time: Timestamp after which the JWT MUST NOT be accepted |
Paste your JWT to inspect.
Understanding JSON Web Tokens
JSON Web Tokens are an open, industry-standard (RFC 7519) method for representing claims securely between two parties. Tokens are divided into three parts separated by dots:
- Header: Contains token type and signing algorithm (e.g. HS256, RS256).
- Payload: Contains claims (user IDs, roles, expiration timestamps).
- Signature: Verifies that the sender of the JWT is who it says it is and ensures content hasn't changed.
100% Client-Side PrivacyJWTs often contain sensitive authorization scopes and user IDs. Our decoder operates completely inside your browser. No tokens are sent over the network.
Base64Url Encoding vs EncryptionJWTs are digitally signed and Base64Url encoded, but NOT encrypted by default (unless using JWE). Never store unencrypted secrets or passwords in the payload.
Using JWT Decoder
Paste a JSON Web Token to read its header and payload. A readable token is not a verified token: signature validation must happen in your authentication system.