JWT Decoder
Decode and inspect JSON Web Tokens — view header, payload, claims and expiry status instantly. No data is sent to any server.
What is a JWT?
Structure
A JWT consists of three Base64URL-encoded parts: Header (algorithm), Payload (claims), and Signature (integrity), joined by dots.
Common Claims
sub (subject), iss (issuer), exp (expiry), iat (issued at), aud (audience), jti (token ID).
Security Note
JWTs are encoded, not encrypted. Never store sensitive data in the payload. Always verify the signature server-side.
Algorithms
Common: HS256 (HMAC-SHA256), RS256 (RSA-SHA256), ES256 (ECDSA). HS256 uses a shared secret; RS256/ES256 use public/private key pairs.
What is JWT Decoder?
A JSON Web Token (JWT) is a compact, URL-safe method for securely transmitting information between parties as a JSON object. JWTs are the most widely used authentication and authorisation mechanism in modern web applications — they are returned by login APIs, stored in browser localStorage or cookies, and sent with every API request in the Authorization header to prove identity without requiring a database lookup on each request.
A JWT consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims — user ID, email, role, expiry time, issued-at time), and the signature (cryptographic proof of authenticity). The header and payload are readable by anyone without a secret key — the signature is what prevents tampering.
Altairys's JWT Decoder instantly decodes a JWT you paste in — showing the header and payload as formatted, readable JSON with human-readable timestamp conversion for exp (expiration), iat (issued at), and nbf (not before) claims. It highlights whether the token is expired, shows the algorithm used (HS256, RS256, etc.), and flags standard claims. Note: this tool decodes (reads) JWTs but does not verify the cryptographic signature — that requires the secret or public key, which should never be entered into any online tool.
How to Use JWT Decoder
- Paste your JWT
Copy a JWT (three dot-separated Base64 strings) and paste it into the input field.
- Inspect header and payload
The tool instantly decodes and formats both sections as readable JSON.
- Check expiry and claims
See exp, iat, and nbf timestamps converted to readable dates and times.
- Check token status
See if the token is expired and verify the algorithm and standard claims present.
Key Benefits
Paste any JWT and see the header and payload decoded to readable JSON in milliseconds.
exp, iat, and nbf Unix timestamps are automatically converted to readable date/times.
Decoding happens entirely in your browser — your JWT is never sent to any server.
Instantly see if a JWT is expired, not yet valid, or currently active.
Frequently Asked Questions
Decoding (reading) a JWT is safe since the header and payload are already public information — they are Base64-encoded, not encrypted. However, never paste a secret key or signing key into any online tool.
No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms). Entering secret keys into online tools is a security risk — signature verification should be done server-side.
The "exp" (expiration) claim is a Unix timestamp after which the token should no longer be accepted. When a token expires, the user must log in again to get a new token. Our tool shows this as a human-readable date.
A session token is an opaque random string that the server looks up in a database to find the user. A JWT is self-contained — it carries the user information inside it, and the server validates the signature without a database lookup.