JWT Decode
Decode JSON Web Tokens
Frequently Asked Questions
What is a JWT and how do I decode it?
A JSON Web Token (JWT) has three Base64-encoded parts separated by dots: header.payload.signature. The decoder splits and decodes the header (algorithm, type) and payload (claims like user ID, expiration) into readable JSON.
Is decoding a JWT the same as verifying it?
No. Decoding simply reads the contents — anyone can do it. Verification checks the signature using the secret key or public key to confirm the token was not tampered with. This tool decodes only; verification requires the signing key.
What information is in a JWT payload?
Common claims: sub (subject/user ID), iat (issued at), exp (expiration), iss (issuer), aud (audience), and custom claims like roles or permissions. The decoder shows all claims with human-readable timestamps for date fields.
How do I check if a JWT has expired?
The decoder reads the exp (expiration) claim and compares it to the current time. It clearly shows whether the token is valid or expired, and how much time remains or has passed since expiration.
What JWT algorithms are commonly used?
HS256 (HMAC-SHA256): symmetric, uses a shared secret. RS256 (RSA-SHA256): asymmetric, uses public/private key pair. ES256 (ECDSA-SHA256): asymmetric, smaller keys. The decoder shows the algorithm in the header section.