Decode, inspect, and validate JSON Web Tokens. View header algorithm, payload claims, expiration time, and signature verification status.
A JSON Web Token is a compact, URL-safe token format used for securely transmitting information between parties. JWTs consist of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. They're widely used for authentication (OAuth 2.0, OpenID Connect), session management, and API authorization.
| Claim | Name | Description |
|---|---|---|
| iss | Issuer | Who created the token |
| sub | Subject | Who the token is about (usually user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration | When the token expires (Unix timestamp) |
| iat | Issued At | When the token was created |
| nbf | Not Before | Token is not valid before this time |
| jti | JWT ID | Unique identifier for the token |
Yes, JWT decoding is completely safe — the header and payload are simply Base64URL encoded, not encrypted. Anyone can decode them. The security of JWT comes from the signature verification, not from hiding the payload.
This tool can decode and inspect JWT tokens, but signature verification requires the secret key (HS256) or public key (RS256), which we don't have access to. It will check if the token is expired based on the exp claim.