Free browser-based tool
JWT Decoder
Decode and inspect JSON Web Tokens (JWT). View header, payload, signature, and expiration time instantly.
Header
algHS256
typJWT
Payload Claims
sub: 1234567890
name: John Doe
iat: 1/18/2018, 1:30:22 AM (271613766s ago)
JWT Structure
A JSON Web Token consists of three Base64URL-encoded parts separated by dots:
header.payload.signature
Header
Contains the token type (JWT) and signing algorithm (HS256, RS256, etc.)
{ "alg": "HS256", "typ": "JWT" }
Payload
Contains claims (user data, expiration, issuer, etc.)
{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022 }
Signature
Verifies the token hasn't been tampered with
HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
Standard JWT Claims
| Claim | Full Name | Description |
|---|---|---|
| iss | Issuer | Who created and signed the token |
| sub | Subject | Who the token is about (usually user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration Time | When the token expires (Unix timestamp) |
| iat | Issued At | When the token was issued |
| nbf | Not Before | Time before which the token is invalid |