JWT Debugger
Decode, encode, and verify JSON Web Tokens. Everything runs in your browser, nothing is sent to a server.
{
...
}{
...
}| Claim | Value | |
|---|---|---|
| No claims to display | ||
About JWTs
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts separated by dots: header.payload.signature.
The header specifies the signing algorithm (e.g. HS256, RS256) and token type.
The payload contains claims - statements about the user and metadata. Standard claims include iss (issuer), sub (subject), exp (expiration), and iat (issued at).
The signature is created by signing the header and payload with a secret or private key, allowing recipients to verify authenticity.
JWTs are not encrypted by default. Anyone can decode the payload. Never store sensitive data in a JWT unless using JWE (JSON Web Encryption).