JWT Decoder
Decode a JSON Web Token to see its header, payload and claims. Decoding only — the signature is not verified.
JWT Token
Header
ALGORITHM & TOKEN TYPE-
Payload
DATA-
Signature
VERIFY SIGNATURE-
A JSON Web Token is three Base64url-encoded parts separated by dots: a header (the algorithm, e.g. HS256), a payload of claims, and a signature. Because the first two parts are only encoded, not encrypted, anyone can read them — paste a token above and this JWT decoder shows the header and payload as formatted JSON, along with the standard claims explained.
What you will see
- Header —
alg(signing algorithm) andtyp, sometimes a key idkid. - Payload — registered claims such as
iss(issuer),sub(subject),aud(audience),exp(expiry),nbf(not before),iat(issued at) andjti(token id), plus any custom claims your application adds. - Signature — the raw Base64url string. This tool does not have your secret or public key, so it cannot verify it.
Verifying a signature
For an HS256 token, the signature is HMAC-SHA256 over base64url(header) + "." + base64url(payload) using the shared secret. You can reproduce it with the HMAC-SHA256 generator (Base64URL output) and compare. Tokens signed with RS256 or ES256 need the issuer's public key.
Treat tokens as secrets even though they decode freely: a valid token grants whatever access it encodes. Read JWT tokens explained for structure, verification pitfalls and expiry handling.