Paste a JWT token to decode its header and payload claims. Runs entirely in your browser - the token is never sent to a server.
Paste a JWT above to decode its header and payload
A JSON Web Token (JWT) has three base64url-encoded parts separated by dots: a header (algorithm and token type), a payload (claims such as user ID, roles, and expiry time), and a signature (proves the token has not been tampered with).
Common uses include API bearer tokens, OAuth 2.0 access tokens, and session tokens in single-page applications. When you paste a JWT here it is decoded entirely in your browser - the token never leaves your device.
The signature can only be verified by a party that holds the signing key. Tokens signed with none are unsigned and must never be trusted. Symmetric algorithms (HS256/384/512) require a shared secret; asymmetric algorithms (RS256, ES256, PS256) use a public/private key pair and can be verified with the public key alone.
The payload contains standard registered claims defined in RFC 7519: iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at), and jti (JWT ID). Applications also add private claims for roles, permissions, and user metadata.
A common debugging scenario: a 401 Unauthorized from an API often means the JWT is expired (exp in the past), has the wrong audience (aud mismatch), or was signed with a different key than the server expects. Paste the token here to inspect the claims and expiry timestamp before digging into server logs.