JWT Decoder/ Client-side
Instantly decode JWT header and payload, view expiry and standard claims. Token never leaves your browser.
Paste a JWT token above to decode it.
Token never leaves your browser.
Did this tool solve your problem?
What is a JWT
A JWT (JSON Web Token) is a compact, URL-safe token format with three parts: Header (algorithm info), Payload (claims/data), and Signature. Commonly used for authentication — the server issues a JWT, the client includes it in requests, and the server verifies the signature without database lookups.
JWT security considerations
Never store sensitive data (passwords, credit cards) in JWT payloads — they're just Base64-encoded and readable by anyone. The signature only ensures data integrity, not confidentiality. Always use HTTPS, set reasonable expiration times (15 minutes to 1 hour recommended), and implement refresh token rotation.
Code Examples
import jwt from 'jsonwebtoken';
// Sign
const token = jwt.sign(
{ sub: 'user_123', role: 'admin' },
process.env.JWT_SECRET,
{ expiresIn: '1h' }
);
// Verify
const payload = jwt.verify(
token, process.env.JWT_SECRET
);import jwt
# Sign
token = jwt.encode(
{"sub": "user_123", "exp": exp_ts},
secret,
algorithm="HS256"
)
# Verify
payload = jwt.decode(
token, secret,
algorithms=["HS256"]
)import "github.com/golang-jwt/jwt/v5"
// Sign
token := jwt.NewWithClaims(
jwt.SigningMethodHS256,
jwt.MapClaims{"sub": "user_123"},
)
signed, _ := token.SignedString(secret)
// Verify
parsed, _ := jwt.Parse(signed,
func(t *jwt.Token) (any, error) {
return secret, nil
})// JWT = base64url(header)
// + "."
// + base64url(payload)
// + "."
// + signature
function decodeJwt(token) {
const [h, p] = token.split('.');
const decode = s => JSON.parse(
atob(s.replace(/-/g,'+')
.replace(/_/g,'/'))
);
return { header: decode(h),
payload: decode(p) };
}