What is a JSON Web Token (JWT) and How Does It Work?
A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, self-contained JSON object. Widely adopted for web authentication and authorization architectures, a JWT is digitally signed using a shared secret (HMAC algorithms like HS256) or a public/private key pair (RSA or ECDSA algorithms like RS256).
Every JWT consists of three distinct parts separated by dots: the Header (identifying token type and signing algorithm), the Payload (containing claims such as user IDs, roles, and expiration dates), and the Signature (cryptographic verification hash). Inspecting tokens is essential for debugging authentication issues, validating token expiration, and auditing payload claims.
🔒 100% Client-Side: UniTools decodes your JWT token entirely in your browser memory using the Web Crypto API. No tokens, keys, or sensitive payloads are sent to any remote server or logged.
How to Use This JWT Decoder (3-Step Quick Guide)
Paste Encoded JWT
Paste any standard three-part JSON Web Token string into the input area.
Inspect Decoded Claims
Review the formatted Header and Payload JSON, including token expiration timestamps and custom claims.
Copy Formatted Output
Copy the entire decoded JSON payload or individual claim values directly to your clipboard for debugging.
Standard Registered JWT Claims
Common claim names defined by RFC 7519 for standard token interoperability.
| Claim | Full Name | Description | Standard Example |
|---|---|---|---|
| iss | Issuer | Identifies the principal that issued the JWT | "iss": "https://auth.company.com" |
| sub | Subject | Identifies the principal subject (user/service ID) | "sub": "usr_98a72b10" |
| aud | Audience | Identifies the recipients that the JWT is intended for | "aud": "https://api.company.com" |
| exp | Expiration Time | Unix epoch timestamp after which token is invalid | "exp": 1735689600 |
| nbf | Not Before | Unix epoch timestamp before which token must not be accepted | "nbf": 1704067200 |
| iat | Issued At | Unix epoch timestamp indicating when token was created | "iat": 1704067200 |
Frequently Asked Questions
Can decoding a JWT verify its signature?
Decoding reveals the payload and header without verification. Complete signature verification requires the secret passphrase or the corresponding public certificate key.
How is JWT expiration represented?
The `exp` field contains a Unix epoch timestamp in seconds. If the current time exceeds this timestamp, the token is expired and must be rejected.
Is it safe to paste production JWTs into UniTools?
Yes. UniTools decodes tokens strictly client-side inside your browser sandbox. No data or tokens are transmitted to external servers or logged.
What is the difference between JWS and JWE?
JWS (JSON Web Signature) tokens are digitally signed so claims are readable by anyone but cannot be tampered with. JWE (JSON Web Encryption) tokens encrypt the payload content for total confidentiality.