RubanTools
Suggest a Tool

JWT Decoder

Paste any JSON Web Token to instantly decode the header, payload, and all claims - expiry shown in human-readable time. No secret needed.

Paste JWT Token

JWT Decoder FAQ

JWT (JSON Web Token) is an open standard (RFC 7519) for transmitting claims as a compact Base64url-encoded JSON object. Three dot-separated parts: Header (alg & type), Payload (claims), Signature. Used widely in REST APIs, OAuth 2.0, and SSO.

The header and payload are Base64url-encoded - not encrypted. Anyone can decode them without the secret. The secret is only needed to VERIFY the signature. Never put passwords or sensitive PII in JWT payloads unless using JWE encryption.

sub (subject/user ID), iss (issuer), aud (audience), exp (expiry), iat (issued-at), nbf (not-before). All timestamps are Unix epoch seconds - this tool converts them to readable IST dates.

Symmetric: HS256/384/512 (HMAC-SHA). Asymmetric: RS256/384/512 (RSA), ES256/384/512 (ECDSA). RS256 is most common in production. Never trust tokens with alg:none in production servers.