JWT Decoder

A JSON Web Token (JWT, defined in RFC 7519) is a compact, URL-safe way to represent a set of claims about a user, with cryptographic proof those claims weren't tampered with. JWTs power authentication in most modern web stacks: when you log in, the server creates a JWT containing your user ID and permissions, signs it with a secret key, and sends it back. Your browser stores the token (usually in localStorage or a cookie) and includes it in the Authorization header of every subsequent request. The server verifies the signature on each request — if it's valid, the claims inside the token are trusted; if it's tampered, the signature breaks and the request is rejected. JWTs have three Base64URL-encoded parts separated by dots: the header declares the signing algorithm (HS256 for HMAC-SHA256, RS256 for RSA, ES256 for ECDSA, none for unsigned tokens — which is dangerous and you should reject those); the payload contains the actual claims (standard claims like 'sub' for subject, 'exp' for expiration, 'iat' for issued-at, plus any custom claims your application defines); the signature is proof the header and payload were signed by someone who held the secret. This decoder reveals the first two parts, which are public information — the signature can only be verified with the key, which is why every JWT decoder displays the claims without verification.