Decode and inspect JWT tokens.
Paste your JWT into the input box and click Decode to instantly see the header, payload claims, and raw signature. All decoding happens in your browser — the token is never sent to any server.
A JWT (JSON Web Token, pronounced "jot") is a compact, URL-safe token format defined in RFC 7519. It is widely used for stateless authentication: after a user logs in, the server issues a JWT, and the client includes it in subsequent requests (typically in the Authorization: Bearer <token> header). The server validates the token without needing to query a session database.
A JWT consists of three Base64URL-encoded parts separated by dots (.):
typ: "JWT") and the signing algorithm (alg), e.g. HS256, RS256, ES256.sub (subject), iat (issued at), exp (expiration), aud (audience), plus any custom fields your application adds.function decodeJWT(token) {
const [header, payload] = token.split('.');
const decode = str => JSON.parse(atob(str.replace(/-/g,'+').replace(/_/g,'/')));
return { header: decode(header), payload: decode(payload) };
}
const { header, payload } = decodeJWT(token);
console.log(payload.exp); // expiration timestamp
import jwt # pip install PyJWT
# Decode without verification (inspect only)
decoded = jwt.decode(token, options={"verify_signature": False})
print(decoded)
# Decode WITH verification (production use)
decoded = jwt.decode(token, secret_key, algorithms=["HS256"])
atob() and JSON.parse(). Nothing leaves your device.exp claim is a Unix timestamp (seconds since Jan 1 1970 UTC) indicating when the token expires. Compare it to Math.floor(Date.now() / 1000) — if exp is less than the current time, the token has expired.none algorithm means the token is unsigned. Many JWT libraries have historically accepted alg: none tokens as valid, which is a critical security vulnerability. Always explicitly whitelist allowed algorithms on the server side.+, /, and = characters that are not safe in URLs and HTTP headers. Base64URL substitutes + → - and / → _, and omits padding, making the token safe to include as a URL parameter or header value without extra encoding.