How to use it
- Paste a JWT token.
- View the decoded header and payload.
- Check the exp and iat dates.
Why use it
- Inspect tokens while debugging.
- Read claims without sharing them.
- Spot expired tokens quickly.
- Nothing leaves your browser.
- Free for auth and API work.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used to transmit claims between parties. It is the backbone of modern authentication: a server signs a token with a secret or private key, sends it to the client, and the client presents it on subsequent requests to prove who it is and what it can do. You will encounter JWTs in OAuth 2.0, OpenID Connect, and most single-page-app and API authentication flows.
The three parts of a JWT
A JWT always has three segments separated by dots: header.payload.signature.
- Header: JSON describing the token type (
typ) and the signing algorithm (alg), such as HS256 or RS256. - Payload: JSON containing the claims, such as the subject (
sub), issuer (iss), issued-at (iat), and expiry (exp). - Signature: the result of signing the header and payload with the secret or private key, used to verify the token has not been tampered with.
Common JWT claims
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: the user or entity the token is about |
aud | Audience: who the token is intended for |
exp | Expiration: Unix timestamp when the token stops being valid |
iat | Issued at: Unix timestamp when the token was created |
Decoding a token is the fastest way to inspect those claims without sharing anything. It is especially useful during development to confirm what a token contains, which endpoints it is scoped to, and when it expires.