What is a JSON Web Token (JWT) and how does it work?

A JSON Web Token (JWT) is an open standard defined by IETF RFC 7519 for securely transmitting information between parties as a compact JSON object. A JWT consists of three Base64Url-encoded segments separated by periods: Header (algorithm & token type), Payload (claims and user metadata), and Signature (cryptographic hash validating authenticity).

Is my secret key or authorization token safe when using this decoder?

Yes, 100%. All decoding, JSON parsing, and timestamp calculations run completely locally inside your web browser's JavaScript engine. Your tokens, headers, and payload claims are never logged, stored, or transmitted across the network.

Is a standard JWT encrypted or merely signed?

Standard JWTs (JWS) are signed and Base64Url-encoded, NOT encrypted. Anyone who intercepts the token can decode and view the payload claims without a secret key. For confidentiality, sensitive credentials should never be placed in a standard JWT payload unless encrypted using JSON Web Encryption (JWE / RFC 7516).

What do standard JWT claim keys (exp, iat, nbf, sub, iss, aud) mean?

Per RFC 7519: 'exp' (Expiration Time) is a Unix timestamp indicating when the token ceases to be valid; 'iat' (Issued At) marks token creation time; 'nbf' (Not Before) marks when the token becomes valid; 'sub' (Subject) identifies the user ID; 'iss' (Issuer) names the identity provider; and 'aud' (Audience) identifies the intended recipient client ID.

Why can't client-side decoders verify HMAC signatures without the secret key?

HMAC signatures (like HS256) require a shared symmetric secret key to compute the hash and confirm integrity. While this client-side tool inspects and parses the unencrypted payload structure, cryptographic signature verification must always be performed securely on your backend server.

Developer

JWT Decoder & Token Inspector

Decode and debug RFC 7519 JSON Web Tokens — inspect headers, payload claims, expiration timestamps, and signature algorithms client-side.

Quick Answer & Summary

A JSON Web Token (JWT) Decoder parses RFC 7519 standard tokens into readable JSON header, payload claims, and signature segments. This client-side tool verifies expiration timestamps (exp), issued-at dates (iat), and audience claims entirely in your browser with zero network exposure.

JWT Structure Specification (RFC 7519)

JWT = Base64URL(Header) + '.' + Base64URL(Payload) + '.' + Signature

Signature = HMAC-SHA256(Base64URL(Header) + '.' + Base64URL(Payload), secret_key)

JWT Token

Share This Tool

Help your team and fellow developers save time with free, private client-side utilities.

X (Twitter)LinkedIn WhatsApp Reddit Facebook

Toolbox Editorial TeamVerified Authors

Systems & Security Engineers • Applied Cryptography & High-Performance Web Tools

Updated: August 2026

100% In-BrowserZero server storage

Standards AuditedRFC & ISO compliant

Peer ReviewedEditorial Policy

Documentation & Guide

How to Use JWT Decoder & Token Inspector

Paste Encoded JWT String

Paste your Bearer token or authorization string into the input box. The tool automatically splits the token by dot delimiters (Header.Payload.Signature).

Inspect Decoded Claims & Expiration

Review the JSON header (algorithm, token type) and payload claims (sub, iss, aud, exp, iat). Active expiration timers highlight whether the token is currently valid or expired.

Copy Decoded JSON Payload

Export or copy formatted JSON payloads directly to your clipboard for application debugging or API test suites.

Pro Tips

JWTs are encoded, not encrypted — never store passwords or credit card numbers in payloads.

Check the 'exp' claim to verify if token expiration is causing HTTP 401 Unauthorized API responses.

All parsing runs 100% client-side in your browser for complete privacy.

Practical Examples & Conversions

Input

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIFNtaXRoIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMiwiZXhwIjoxODMxNjIzOTAyMn0.4f81c9a...

Output

Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "1234567890", "name": "Alice Smith", "admin": true, "iat": 1516239022, "exp": 18316239022 }

Frequently Asked Questions (PAA)

Related Tools & Converters

Air-Gapped Certificate Inspector

Decode X.509 SSL certs and SAN domains client-side

RSA Keypair Generator

Generate 2048/4096-bit RSA public/private keys

HMAC Signature Verifier

Verify HMAC-SHA256 signatures with secret keys

Cryptographic Hash Generator

Generate SHA-256, SHA-512, and MD5 hashes

Authoritative Standards & Citations

Calculations and algorithms on this page are implemented and verified in strict accordance with the following official technical specifications:

IETF (Internet Engineering Task Force)

RFC 7519: JSON Web Token (JWT)

Standardized compact, URL-safe means of representing claims to be transferred between two parties.

W3C Recommendation

Web Cryptography API Specification

Standard JavaScript API for performing basic cryptographic operations in web applications.

IETF Standards Track

RFC 4122: A Universally Unique IDentifier (UUID) URN Namespace

Definition of uniform format and generation algorithms for UUIDs.