JWT Decoder & Validator

A JSON Web Token (JWT) is a compact, URL-safe token format used for authentication and information exchange. It has three Base64url-encoded parts separated by dots: header (algorithm + type), payload (claims), and signature. The signature verifies the token hasn't been tampered with.

Standard registered claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). All are optional but widely used for auth flows. Custom claims can be added freely.

No. Signature validation requires your private/public key or secret, which you should never paste into any online tool. This decoder shows header and payload contents and validates structural claims (expiry, not-before). Always validate signatures server-side.

Some JWT libraries accept tokens with alg: none in the header, bypassing signature verification entirely. This is a critical vulnerability. Always explicitly whitelist allowed algorithms in your JWT library and reject 'none' as an algorithm.

The exp claim is a Unix timestamp (seconds since epoch). When the current time exceeds exp, the token is expired and should be rejected by your server. This decoder shows how much time remains (or how long ago it expired) relative to your local clock.