JWT Decoder

Deconstructing the Three Parts of a JWT

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. As defined in RFC 7519, a JWT is composed of three distinct parts separated by dots: the Header, the Payload, and the Signature.

The Header contains metadata about the token, such as the algorithm used (e.g., HS256 or RS256) and the token type. The Payload contains the claims, which are assertions about an entity (typically a user) and additional metadata (like issuance and expiration times). The Signature is computed by combining the encoded header, payload, and a secret key, allowing receivers to verify that the token has not been altered.

Base64URL Encoding vs. Standard Base64

JWT parts are encoded using Base64URL encoding, which is a variation of standard Base64 encoding. It replaces the characters '+' and '/' with '-' and '_' respectively, and omits trailing '=' padding characters. This ensures the token can be safely passed in URL query parameters and HTTP headers without requiring special character escaping.

Decoding a JWT simply translates these Base64URL strings back into standard UTF-8 JSON text. Our client-side JWT decoder isolates each segment, parses the JSON claims, and checks the expiration timestamp ('exp') to display a real-time validity countdown.

Why You Should Decode Tokens Locally

JSON Web Tokens serve as bearer credentials. Anyone who obtains a valid JWT can access the APIs and user resources it covers. Pasting active JWTs into external server-side decoding websites exposes your credentials. Our tool decodes your token completely client-side in browser memory, ensuring your API access tokens remain strictly confidential.