About JSON Web Tokens
A JWT has three Base64URL-encoded parts separated by dots: a header (the signing algorithm), a payload (claims such as user ID and expiry) and a signature.
Important
- Decoding is not verifying. Anyone can read a JWT's payload; only the signature proves it hasn't been tampered with. This tool does not verify signatures.
- Never put secrets such as passwords in a JWT payload — it is only encoded, not encrypted.
- Treat real tokens like passwords: this page decodes them locally and never sends them anywhere, but avoid pasting live production tokens into tools you don't trust.
Common claims
iss issuer · sub subject (user) · aud audience · exp expiry time · nbf not valid before · iat issued at · jti token ID.