What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims passed between two parties. It's made up of three parts separated by dots (`.`): a Header, a Payload, and a Signature.

Header.Payload.Signature

• The Header tells you the token type (JWT) and which signing algorithm was used — typically HMAC SHA256 or RSA.
• The Payload is where the actual data lives. These are called "claims" — things like the user's ID (`sub`), their name, when the token expires (`exp`), and when it was issued (`iat`). You can also add your own custom claims here.
• The Signature is what keeps the token trustworthy. It proves the token hasn't been tampered with since it was issued — and that the sender is who they claim to be.

Why Do Developers Use JWTs?

• Authentication is the big one. Once a user logs in, the server hands them a JWT. That token then travels with each subsequent request so the server can verify who's asking — without needing to hit a session store every time.
• They're also useful for securely passing information between services. Because the token is signed, you can trust the data inside it without making an extra round-trip to verify it.
• Since the payload carries everything the server needs to know about the user, there's no session state to store in a database. That's a big deal when you're scaling horizontally — it's just simpler.

How This Decoder Helps

The Header and Payload of a JWT are just Base64Url-encoded JSON — so anyone can decode them. This tool makes that instant.

• Paste a token from an HTTP request header and you'll immediately see what's inside. Check the user ID, the expiration time, when it was issued, or any custom claims you've added.
• It's handy when you're debugging an auth flow and want to confirm the token actually contains the right user info and permissions without writing throwaway code.
• The `exp` claim is a Unix timestamp. Figuring out if a token is expired usually means cracking open a console and doing some math — this tool just tells you directly.

Important: This tool only decodes the token. It does not verify the signature, which would require the secret key. Never share your secret key with any online tool.