JWT Decoder & Validator
Decode JSON Web Tokens instantly. Inspect header, payload, claims, and signature. Check expiration and algorithm security — 100% client-side, no data leaves your browser.
Standard JWT Claims Reference
| Claim | Full Name | Description |
|---|---|---|
| iss | Issuer | Who issued the token |
| sub | Subject | The subject of the token (usually user ID) |
| aud | Audience | Intended recipient(s) of the token |
| exp | Expiration | Token is not valid after this timestamp |
| iat | Issued At | When the token was issued |
| nbf | Not Before | Token is not valid before this timestamp |
| jti | JWT ID | Unique identifier for the token |
FAQ
Can this tool verify the JWT signature?
No. Signature verification requires the secret key or public key used to sign the token, which is never included in the JWT itself. This tool decodes the token and shows the signature bytes, but cryptographic verification must be done server-side with the appropriate key.
Is it safe to paste my JWT token here?
Yes. All decoding happens entirely in your browser. No data is sent to any server. JWTs are not secret — they are designed to be transportable. However, the payload may contain sensitive claims, so be mindful of your surroundings.
What does the "none" algorithm warning mean?
The "none" algorithm means the token has no signature at all. This is a serious security concern — anyone can modify the payload of an unsigned token. Legitimate tokens should always be signed with a proper algorithm like RS256 or ES256.
Why are HS256/HS384/HS512 flagged?
HMAC-based algorithms use a shared secret. If the secret is weak or leaked, anyone can forge tokens. RSA (RS256+) and ECDSA (ES256+) algorithms use asymmetric keys — the signing key is kept private and only the public key is needed for verification, which is more secure for distributed systems.
What do iat, exp, and nbf timestamps mean?
These are Unix timestamps (seconds since Jan 1, 1970). iat (issued at) is when the token was created, exp (expiration) is when it stops being valid, and nbf (not before) is the earliest time it can be used. This tool converts them to human-readable dates.