20% OFF Get 20% off Hostinger Web Hosting, Business Email & Marketing bundle! Claim Deal →
News
jwt_decoder.js READY
FORMAT:  header.payload.signature
// token preview
Paste a token above to see it highlighted…
● HEADER — algorithm & type
● PAYLOAD — claims & data
● SIGNATURE — raw Base64Url
Signature not verified. To verify this token, you need the secret key or public key used to sign it. This tool only decodes — it cannot confirm authenticity.
Raw signature
§ Docs How to Use
Copy your JWT token
Find your token in an API response, browser DevTools (Application → Cookies / LocalStorage), or auth header. It starts with eyJ and contains exactly two dots separating three parts.
Paste into the input
Paste the full token into the text area. Watch the preview highlight each part: header, payload, and signature in distinct colors.
Click Decode Token
Hit the Decode button (or press Ctrl+Enter). The tool Base64Url-decodes each section and displays it as formatted JSON. Switch between Header, Payload and Signature tabs to inspect each part.
Inspect claims
The Payload tab shows standard claims (exp, sub, iat, iss) with plain-English explanations. Expired tokens are flagged in red automatically.
⊞ Reference Standard Registered JWT Claims (RFC 7519)
Claim Full Name Format / Type Description
sub Subject String Principal ID (e.g. user ID or entity account).
iss Issuer String / URL Identity provider that issued the token (e.g. Auth0, Firebase).
aud Audience String / Array Recipient or resource server the JWT is intended for.
exp Expiration Time NumericDate (Seconds) Unix epoch after which the token is invalid and must be rejected.
nbf Not Before NumericDate (Seconds) Time before which the JWT must NOT be accepted for processing.
iat Issued At NumericDate (Seconds) Unix epoch when the token was created.
jti JWT ID String (UUID) Unique identifier to prevent token replay attacks.
</> Code How to Verify & Decode JWT in Code
⚡ Node.js (jsonwebtoken)
const jwt = require('jsonwebtoken');

// Decode without verification
const decoded = jwt.decode(token);

// Verify signature with secret
try {
  const verified = jwt.verify(token, 'SECRET_KEY');
} catch (err) {
  console.error('Invalid token:', err.message);
}
🐍 Python 3 (PyJWT)
import jwt

# Decode without verification
payload = jwt.decode(token, options={"verify_signature": False})

# Verify signature
try:
    data = jwt.decode(token, "SECRET_KEY", algorithms=["HS256"])
except jwt.ExpiredSignatureError:
    print("Token expired")
🐘 PHP (firebase/php-jwt)
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

// Verify and decode
try {
    $decoded = JWT::decode($token, new Key($secret, 'HS256'));
    $userId = $decoded->sub;
} catch (\Exception $e) {
    echo 'Token error: ' . $e->getMessage();
}
? FAQ Frequently Asked Questions
A JWT (JSON Web Token) is a compact, URL-safe way to transmit information between parties as a signed JSON object. It has three parts separated by dots: a header (algorithm), a payload (claims/data), and a signature (integrity proof). JWTs are widely used for authentication and API authorization.
Yes — completely. This tool runs 100% in your browser. Your token is never sent to any server, never logged, never stored. You can verify by disconnecting your internet and it will still work. The decoding is pure JavaScript running on your device.
The payload contains "claims" — statements about the user or entity. Standard claims include sub (subject/user ID), iat (issued at), exp (expiration), iss (issuer), aud (audience), and nbf (not before). Applications can also add any custom claims.
Yes. Decoding only Base64Url-decodes the parts — it does not validate the expiry time. Any structurally valid JWT will decode. The tool shows the exp value and flags expired tokens in red so you can immediately see they've expired.
No. Verification requires the secret key (HMAC: HS256, HS512) or public key (RSA/ECDSA: RS256, ES256) used to sign the token. This tool only decodes — it cannot confirm the token is authentic. For server-side verification use jsonwebtoken (Node.js), PyJWT (Python), or your language's equivalent.