JWT Decoder
Decode JSON Web Tokens. Parse Header and Payload content with automatic timestamp recognition
What is JWT?
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties. It consists of three parts: Header, Payload, and Signature. JWT is widely used in web application authentication and information exchange scenarios.
JWT is widely used in OAuth authentication, API authorization, and Single Sign-On (SSO). This tool supports automatic parsing of standard JWT format, decoding Base64-encoded header and payload into readable JSON data.
JWT Structure
JWT consists of three parts, each Base64URL encoded:
- Header（头部）：Header: Declares the token type and signing algorithm used (e.g., HS256, RS256).
- Payload（负载）：Payload: Contains Claims, the data being transmitted. Standard claims include issuer (iss), subject (sub), audience (aud), expiration time (exp), issued at (iat), and more.
- Signature（签名）：Signature: Used to verify the token's integrity and authenticity, preventing tampering.
Common Use Cases
JWT is widely used in the following scenarios:
- User authentication in web applications (login tokens)
- API endpoint authentication and authorization
- Single Sign-On (SSO) systems
- Secure information transfer between microservices
FAQ
Is JWT Payload data encrypted?
No. JWT Header and Payload are only Base64URL encoded, which anyone can decode and read. JWT security doesn't rely on data encryption but on signature verification to prevent tampering. Sensitive information should not be placed directly in JWT Payload.
Can this tool verify JWT signatures?
No. This tool is only for decoding and viewing JWT Header and Payload content. Signature verification requires knowing the secret key, which is typically only known to the server.
Are JWT tokens uploaded to a server?
No. All decoding is done locally in your browser. Tokens are never sent to any server. You can safely paste any token for debugging.
How to check if a JWT is expired?
Check the exp (expiration time) field in the Payload, which is a Unix timestamp. This tool automatically converts exp to a readable date and indicates whether it has expired.