What is JWT and how to decode it
A JSON Web Token (JWT) is a compact, URL-safe token format used for transmitting claims between parties. Every JWT consists of three dot-separated parts: the header (which declares the signing algorithm and token type), the payload (which contains the claims — data like user id, expiration time and issue time, often called 'iat' and 'exp'), and the signature (a cryptographic hash that verifies the token has not been altered). This free online tool decodes any valid JWT token instantly, showing the decoded header and payload in a clean JSON view along with human-readable timestamps. No data is uploaded to any server — everything happens in your browser.
Frequently Asked Questions
Is JWT decoding safe? Does this tool send my token anywhere?
Yes, it is completely safe. JWT decoding happens entirely in your browser — the token never leaves your device. No data is sent to any server. The tool simply base64-decodes the header and payload of the token and displays the JSON content locally.
Does this tool verify the JWT signature?
No, this tool does not verify the cryptographic signature. It only decodes and displays the three parts of a JWT: header, payload, and signature. Signature verification requires the secret or public key, which this browser-only decoder does not have access to — by design, for your security.
What is the difference between decoding and verifying a JWT?
Decoding a JWT means reading the base64-decoded content of the header and payload — anyone can do this with any JWT. Verifying a JWT means checking the cryptographic signature against the header and payload using a secret key (HMAC) or public key (RSA/ECDSA) to ensure the token has not been tampered with.
What do exp and iat mean in a JWT payload?
exp (expiration) is the timestamp after which the token is no longer valid. iat (issued at) is the timestamp when the token was created. Both are Unix timestamps in seconds. This tool automatically converts them to human-readable dates and indicates whether the token has expired.
What are the three parts of a JWT?
A JSON Web Token consists of three parts separated by dots: 1) Header — contains the signing algorithm (e.g., HS256, RS256) and token type (JWT). 2) Payload — contains the claims like sub, name, iat, exp. 3) Signature — a cryptographic hash of the encoded header and payload.