Decode and Analyze JWT Tokens

Navigate to OnlineTools4Free JWT Decoder. The tool splits any JWT into its three parts: header, payload, and signature.

Copy a JWT from your browser DevTools (Application > Cookies or Network > Authorization header) or from an API response. Paste the entire token — it is a long string of three base64 segments separated by dots.

The header shows the signing algorithm (HS256, RS256, ES256) and token type. HS256 uses a shared secret (symmetric). RS256 uses RSA public/private keys (asymmetric, more common in production). The algorithm tells you how to verify the signature.

The payload contains claims — key-value pairs with user data and metadata. Standard claims include: sub (subject/user ID), iat (issued at), exp (expiration), iss (issuer), aud (audience). Custom claims contain application-specific data like roles, permissions, and email.

The tool highlights whether the token is currently valid or expired based on the exp claim. Compare iat (issued at) and exp (expiration) to see the token's lifetime. Short-lived tokens (15-60 minutes) are more secure.

The third segment is the signature, created by signing the header + payload with a secret key. The decoder shows the signature but cannot verify it without the secret key. In production, your server verifies the signature to ensure the token has not been tampered with.