JWT Decoder

Inspect tokens locally — no verify, decode only

Paste JWT token

—

Status

Header

—

Payload

—

—

Algorithm

—

Expires

—

Issued

—

Issuer

Decode ≠ verify

Decoding shows the CLAIMS — but proves nothing. An attacker can decode, change \"role\" to \"admin\", and re-encode in 30 seconds. Always verify the signature on the server with the secret/key. Never trust decoded claims client-side for authorization decisions.

Related tools

JWT anatomy

HEADER.PAYLOAD.SIGNATURE
│       │       │
│       │       └─ HMAC(RSA/ECDSA) of (header.payload, secret)
│       └─ Claims: {sub, iat, exp, aud, iss, jti, custom...}
└─ {alg: HS256 | RS256 | ES256..., typ: JWT}

HS256: symmetric HMAC + SHA-256 — same secret signs & verifies (microservices)
RS256: asymmetric RSA — private key signs, public key verifies (OAuth providers)
ES256: ECDSA using P-256 — smaller signatures, newer standard
none: alg:none tokens are unsigned — REJECT THESE on every server

Standard claims: sub subject / iss issuer / aud audience / exp expiration / iat issued-at / nbf not-before / jti unique ID (for revocation).