Instantly decode any JSON Web Token — header, payload, claims and expiry. 100% client-side, nothing sent to server.
A JWT has three parts separated by dots: HEADER.PAYLOAD.SIGNATURE
Header — algorithm (alg) and token type (typ)
Payload — claims: sub (user), exp (expiry), iat (issued at), custom data
Signature — HMAC/RSA of Header.Payload — not decoded here
JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and information exchange. It consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. The header contains the algorithm, the payload contains claims (user data, expiry, etc.), and the signature verifies the token.
This tool decodes JWTs entirely in your browser — no data is sent to any server. However, treat JWTs like passwords: do not paste production access tokens in any online tool unless you are sure they are expired or not sensitive. Use a test/expired token for debugging.
Session cookies store a session ID on the server; the server looks up the user on each request. JWTs are stateless — all user information is in the token itself, so the server doesn't need a database lookup. JWTs are better for distributed/microservice architectures; session cookies are simpler for traditional web apps.
Standard JWT claims (RFC 7519) include: iss (issuer), sub (subject/user ID), aud (audience), exp (expiry time), nbf (not before), iat (issued at), and jti (JWT ID). Custom claims can be added for application-specific data like roles, email, or permissions.
JWT verification requires a secret key (for HS256) or public key (for RS256). This tool only decodes the token — it shows the claims without verifying the signature. To verify a JWT, use your server-side library with the correct secret/public key. An unverified token should not be trusted.