JWT Decoder

A JWT is a compact, URL-safe way to represent claims between parties. It has three parts: header (algorithm and type), payload (claims/data), and signature. Parts are Base64URL encoded and separated by dots. JWTs are commonly used for authentication and API access.

No! Anyone can decode a JWT - the payload is just Base64, not encrypted. Verification requires checking the signature using the secret or public key. Our decoder shows the contents but doesn\\

Standard claims: iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at), nbf (not before). Custom claims contain application-specific data. Our decoder highlights registered claims and expiration status.

The \\

JWTs are signed but not encrypted by default - anyone can read the payload. Never put sensitive data (passwords, private info) in JWTs unless using JWE (JSON Web Encryption). Keep payloads minimal - just enough for authorization decisions.