🔑 JWT Decoder

Paste a JSON Web Token to inspect its header, payload, and claims - processed entirely in your browser, never sent to any server.

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature. JWTs are commonly used for authentication and authorization in web APIs.

Security considerations

Algorithm: none - JWTs with alg: none have no signature and should never be accepted
Expiry (exp) - Always verify the exp claim server-side; expired tokens must be rejected
HS256 vs RS256 - Symmetric (HS256) tokens share a secret; asymmetric (RS256) use public/private keys
Sensitive data - JWT payloads are Base64-encoded, not encrypted. Never put passwords or PII in a JWT