JWT Decoder | Shining Toolbox

About JWT Decoder

How to Use the JWT Decoder

1. Paste your JWT - Copy the complete token including all three parts
2. Click Decode - The tool parses and displays each section
3. Inspect the payload - View claims, timestamps, and custom data
4. Check validity - See if the token is expired or not yet valid

JWT Structure Explained

Header (Red)

{
  "alg": "HS256",
  "typ": "JWT"
}

Contains metadata about the token type and signing algorithm.

Payload (Purple)

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022,
  "exp": 1516325422
}

Contains the claims - statements about the user and additional data.

Signature (Cyan)

Created by signing the encoded header and payload with a secret key.

Standard JWT Claims

Common Use Cases

• API Authentication: Verify user identity in REST APIs
• Single Sign-On (SSO): Share authentication across services
• Information Exchange: Securely transmit data between parties
• Debugging: Inspect token contents during development

Security Notes

• ⚠️ JWTs are not encrypted - The payload is only Base64 encoded
• ⚠️ Never put sensitive data in JWT payloads
• ⚠️ Always verify signatures on the server side
• ⚠️ Check expiration before trusting token claims