Decode and inspect JSON Web Tokens. Header, payload, claims, expiration. 100% client-side.
A JSON Web Token is a compact, URL-safe format for transmitting claims between two parties. JWTs are widely used for authentication and authorization in web applications, APIs, and microservices. After a user logs in, the server issues a signed JWT that the client includes in subsequent requests to prove identity.
Unlike session-based authentication where state is stored on the server, JWTs are stateless. The server validates the token signature without database lookups, making them efficient for distributed systems.
A JWT consists of three Base64URL-encoded parts separated by dots: header.payload.signature.
| Part | Contains | Example fields |
|---|---|---|
| Header | Algorithm and token type | alg: HS256, typ: JWT |
| Payload | Claims (user data, metadata) | sub, iat, exp, iss, roles |
| Signature | Integrity verification | HMAC-SHA256 or RSA/ECDSA |
exp claim never expire, granting permanent access if stolen.No. All decoding happens entirely in your browser using JavaScript. The token is parsed locally and no network requests are made with your JWT data.
Session tokens are opaque identifiers that require server-side storage to look up user data. JWTs are self-contained and carry user claims in the payload, eliminating the need for session storage. JWTs scale better in distributed systems but cannot be revoked without additional infrastructure like a blocklist.
This tool decodes and inspects the JWT structure, claims, and expiration. Signature verification requires the signing key, which only the issuing server should possess. Use this tool to inspect token contents during development and debugging.