JWT Decoder & Token Inspector

Decode, inspect, and debug JSON Web Tokens (JWT). View claims, signature algorithms, header metadata, and expiration timestamps securely in your browser.

Raw JWT Token

Sample Tokens
Token Segment Colors
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsZXggSm9obnNvbiIsInJvbGUiOiJ1c2VyIiwiYWRtaW4iOmZhbHNlLCJpYXQiOjE3MDQwODAwMDAsImV4cCI6MjA4MjcyNjQwMH0.P-18t9c1jD3L8Y7_l4b6U3B4dE6kS9T1vX8yZ2wA5cE
Token Validation State
HS256
Active & Valid

Algorithm

HS256

Type

JWT

Issued

1/1/2024

Expires

12/31/2035

Decoded Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Decoded Payload (Claims)
{
  "sub": "1234567890",
  "name": "Alex Johnson",
  "role": "user",
  "admin": false,
  "iat": 1704080000,
  "exp": 2082726400
}
Signature Hash

P-18t9c1jD3L8Y7_l4b6U3B4dE6kS9T1vX8yZ2wA5cE

Zero-Knowledge Security Invariant

JWT decoding is executed purely in local browser memory. Secret signing keys are never required or requested for claim inspection.

JWT Token Architecture & Cryptographic Verification Invariants

JSON Web Tokens conform to the RFC 7519 open standard for stateless claim exchange across distributed microservices.

1. Dot-Delimited JWS Token Structure
Base64Url(Header).Base64Url(Payload).Base64Url(Signature)
2. HMAC-SHA256 Signature Verification Invariant
Signature=HMAC-SHA256( B64(Header) ∥ "." ∥ B64(Payload), SecretKey )
Step-by-Step JWT Claims Inspection Breakdown
Step 1: Parse Header Metadata Segment
{ "alg": "HS256", "typ": "JWT" }: Declares symmetric HMAC-SHA256 signing.
Step 2: Base64Url Decode Claims Payload
{ "sub": "1234567890", "role": "user", "exp": 2082726400 }
Step 3: Evaluate Expiration & Temporal Validity
Status=Active & Valid Token (Expiry > Current Timestamp)

Standard JWT Reserved Claims Reference

Claim KeyFull NameValue TypeRFC 7519 Purpose
issIssuerString / URIIdentifies the principal authority that issued the token
subSubjectString (User ID)Unique identifier of the entity or user
expExpiration TimeNumericDate (Seconds)Timestamp on or after which the token must not be accepted
iatIssued AtNumericDate (Seconds)Timestamp at which the JWT was created
nbfNot BeforeNumericDate (Seconds)Timestamp before which the JWT must not be accepted

Frequently Asked Questions

What is a JSON Web Token (JWT)?
A JSON Web Token is an RFC 7519 open standard for securely transmitting digitally signed claims as a compact JSON object. It consists of three dot-separated components: Header (algorithm & token type), Payload (claims/user data), and Signature (cryptographic hash).
Is it safe to decode JWTs in this browser tool?
Yes, 100% safe. JWT header and payload sections are Base64Url-encoded strings and are never encrypted. All decoding is processed locally in your client browser engine without transmitting any token data to external servers.
What is the difference between symmetric (HS256) and asymmetric (RS256) algorithms?
HS256 uses a single shared secret key to both sign and verify tokens. RS256 uses asymmetric public/private key pairs: the authentication server signs tokens using a private RSA key, while microservices verify tokens using the public key.
What are standard reserved JWT claims?
Standard claims include `iss` (Issuer), `sub` (Subject/User ID), `aud` (Audience), `exp` (Expiration Unix Timestamp), `nbf` (Not Before Time), `iat` (Issued At), and `jti` (Unique JWT ID).

Related Tools