JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties. It consists of three parts: Header (algorithm and token type), Payload (claims/data), and Signature (verification). JWTs are commonly used for authentication and authorization in web applications and APIs.

How do I decode a JWT token online?

To decode a JWT token: 1) Copy your JWT token (it looks like xxx.yyy.zzz with three parts), 2) Paste it into the input field, 3) The tool will automatically decode and display the Header, Payload, and Signature sections. You'll also see the algorithm used, expiration time, and all claims.

Is it safe to decode JWT tokens online?

Yes, this tool is safe because all decoding happens in your browser (client-side processing). Your JWT tokens are never sent to any server. However, JWTs often contain sensitive information, so only use tokens from development/testing environments, not production tokens with real user data.

JWT claims are key-value pairs in the payload that carry information. Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). Custom claims are additional fields you define for your application, like user_id, email, or role.

How do I check if a JWT token is expired?

Our tool automatically checks the "exp" (expiration) claim in your JWT and displays the expiration status with a colored badge. You'll see "Valid" (green) if not expired, "Expired" (red) with how long ago it expired, or "Future Token" (yellow) if the expiration is in the future.

JWT调试器

实时解码和验证JSON Web Token(JWT)

JWT令牌

在此粘贴JWT令牌...

提示

• 粘贴JWT令牌即可解码并查看其内容

• 令牌分为头部(算法)、负载(声明)和签名三部分

• 检查过期时间(exp)以验证令牌是否仍然有效

• 此工具可以使用密钥或公钥验证签名

• HS256/384/512使用密钥，RS256/384/512/ES256/384/512使用公钥

• 对于RS256/ES256，请粘贴PEM格式的公钥 (-----BEGIN PUBLIC KEY-----)