JWT Decoder
Free online JWT decoder. Decode JSON Web Tokens instantly to view header, payload and signature. No registration required.
What is a JWT (JSON Web Token)?
JWT (JSON Web Token) is an open standard for securely transmitting information between parties as a JSON object. It consists of three parts: Header, Payload, and Signature, separated by dots. JWTs are widely used for authentication and information exchange.
How does a JWT decoder work?
A JWT decoder splits the token by dots and decodes each part (Header and Payload) from Base64URL encoding to display the JSON content. The Signature remains encoded as it's used for verification. No secret key is needed to decode a JWT.
Is it safe to decode a JWT?
Yes, decoding a JWT is safe. It only reads the token content without verifying the signature. However, never store sensitive data in JWT payloads as anyone can decode them. JWTs are encoded, not encrypted.
What are the three parts of a JWT?
A JWT has three parts: 1) Header - contains token type and signing algorithm (e.g., HS256, RS256). 2) Payload - contains claims like user data, expiration time (exp), issuer (iss), and subject (sub). 3) Signature - verifies token integrity and authenticity.
What algorithms does JWT support?
JWT supports multiple algorithm families: HMAC (HS256, HS384, HS512) for symmetric signing, RSA (RS256, RS384, RS512) for asymmetric signing, ECDSA (ES256, ES384, ES512), and EdDSA. The algorithm is specified in the Header.
Does this tool verify JWT signatures?
No, this tool only decodes the token to display Header, Payload, and Signature contents. Signature verification requires the secret key (for HMAC) or public key (for RSA/ECDSA). This tool is for debugging and inspection, not authentication.
What is the difference between JWT and session cookies?
JWTs are stateless - all user information is stored in the token itself, so the server doesn't need to maintain a session store. Session cookies require server-side storage. JWTs are ideal for APIs and microservices, while session cookies are traditional for server-rendered web apps.
Can I modify a decoded JWT?
You can decode and read a JWT freely, but modifying the Payload or Header will invalidate the Signature. A tampered JWT will fail signature verification on the server side. This makes JWTs tamper-evident - any unauthorized change is detectable.
What is the difference between JWT encoding and encryption?
JWT encoding (Base64URL) is a reversible transformation that makes the token compact and URL-safe. It provides no confidentiality. JWT encryption (JWE) adds an encryption layer that protects the payload content. Standard JWTs (JWS) are signed but not encrypted.
Where are JWTs commonly used?
JWTs are widely used in: single sign-on (SSO) systems, OAuth 2.0 and OpenID Connect protocols, RESTful API authentication, microservice-to-service communication, and mobile app authentication. They enable stateless, scalable authentication across distributed systems.
How can I tell if a JWT is expired?
Check the Payload section for the "exp" (expiration time) claim. It contains a Unix timestamp indicating when the token expires. If the current time is past the exp value, the token is expired. Other useful claims include "iat" (issued at) and "nbf" (not before).