Free JWT Decoder

What Is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe string used to transmit information between parties as a JSON object. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature.

JWT Structure

• Header — declares the token type (JWT) and the signing algorithm (HS256, RS256, etc.).
• Payload — contains the claims: data about the user and metadata like expiry (exp), issued-at (iat), and not-before (nbf).
• Signature — proves the token was issued by a trusted party. For HMAC tokens, this is computed with a shared secret. For RSA/EC tokens, a private key signs and a public key verifies.

Common Standard Claims

• sub — Subject (usually the user ID)
• iss — Issuer (who created the token)
• aud — Audience (who the token is intended for)
• exp — Expiry time (Unix timestamp)
• iat — Issued at (Unix timestamp)
• nbf — Not valid before (Unix timestamp)

Security Notes

JWTs are encoded, not encrypted by default — anyone with the token can read the payload. Never store sensitive data (passwords, credit cards) in a JWT unless you also encrypt it (JWE). Always verify the signature on the server side before trusting claims.

Learn how JWTs fit into modern authentication and 2FA →