JWT Decoder

A JWT has the form header.payload.signature:

1. The token is split on . — exactly three parts are expected.
2. Each of the first two parts is Base64url-decoded (like Base64, but with - and _ instead of + and /, and padding often omitted) and parsed as JSON.
3. The header typically says {"alg":"HS256","typ":"JWT"}; the payload carries the claims (sub, exp, iat, custom fields).
4. The exp claim is a Unix timestamp in seconds — the tool compares it with the current time to flag expiry.

The signature part is displayed as opaque: verifying it requires the secret or public key, which a browser tool should never ask for.

Decode eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFhcmF2IFNoYXJtYSIsImlhdCI6MTUxNjIzOTAyMn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c (the classic jwt.io example). The header shows HS256 signing, and the payload shows sub: "1234567890", name: "Aarav Sharma" and iat: 1516239022.

Header tells you the signing algorithm (alg) — watch out for alg: "none", which means the token is unsigned. Payload shows the claims: who the token is for, when it was issued, when it expires, and any custom data the issuer added.

Signature is NOT verified. This tool only decodes — it cannot tell you whether the token is authentic. A decoded payload proves nothing about trust; always verify signatures on your server with the issuer's key before acting on a token's claims.