JWT decoder
Parses a JSON Web Token into header, payload and signature with claim explanations. Plus optional HMAC signature verification right in the browser — your secret never leaves the page.
01
Decoder
03
HMAC signature verification
04
About JSON Web Token
3 parts, dot-separated
Formatheader.payload.signature
JWT is a Base64url string of three parts separated by dots. Header — algorithm and type. Payload — a set of claims (data). Signature — signs header+payload with a secret. All three parts are Base64url without padding, readable by eye if you want.
Header and algorithms
algHS256, HS384, HS512 · RS256, ES256, none
HS* — symmetric, signed with a shared secret (HMAC-SHA). RS*/ES* — asymmetric, with a private key (RSA/ECDSA). alg: 'none' means unsigned — accept only for debugging, never in prod. Never trust the alg from the header during validation — pin the acceptable set.
Standard claims
RFC 7519iss, sub, aud, exp, nbf, iat, jti
Reserved fields from the spec: iss (issuer), sub (subject), aud (audience), exp (expiration, Unix), nbf (not before), iat (issued at), jti (unique id). Your app can add any custom claims (name, email, roles). Names are usually short to keep the token small.
Do and don't
Securityno: password · yes: id, roles, expiry
JWT doesn't encrypt, only signs — anyone can read the payload. Never put passwords, card numbers, PII. Do put user id, roles, expiry. Keep the secret server-side only. On compromise — short lifetime (exp) + refresh mechanism.