JWT Decoder
Decode a JWT token's header and payload. Everything runs in your browser.
Related Tools
JWT Anatomy: Header, Payload, Signature
A JSON Web Token is three Base64Url segments joined by dots. The header declares the signing algorithm, the payload carries claims (who, when, what for), and the signature lets the server detect tampering.
1. Standard Claims Worth Knowing
- exp: expiry time (Unix seconds) — tokens past this moment must be rejected.
- iat: issued-at time, useful for debugging token lifetimes.
- sub / aud / iss: subject, audience, and issuer — who the token is about, for, and from.
2. Debugging Expired Sessions
Most "random logout" bugs come down to exp. Decode the token, compare exp with the current time, and check whether your refresh logic fires before — not after — expiry.
3. Security Rules of Thumb
Never store secrets in the payload, always verify signatures server-side, keep lifetimes short, and prefer httpOnly cookies over localStorage for storing tokens in browsers.