JWT डिकोडर

What is JWT डिकोडर?

A JWT (JSON Web Token) decoder splits a compact JWT string into its three Base64URL-encoded parts — header, payload, and signature — and decodes the header and payload into readable JSON. JWTs are defined by RFC 7519 and are widely used for stateless authentication: a server issues a signed token that a client presents on subsequent requests. Decoding lets you inspect claims (issuer, subject, expiry, roles) without the signing key.

How It Works

The tool splits the input on the two period (.) separators into header, payload, and signature segments. Each of the first two segments is Base64URL-decoded into UTF-8 bytes, then parsed as JSON. The signature segment is displayed as a hex or Base64 string. The tool does NOT verify the signature — verification requires the server's secret or public key and is intentionally out of scope. Expiry (exp) and not-before (nbf) claims are highlighted for quick inspection.

Common Use Cases

• Inspecting auth tokens during development — read the claims a server embedded in a JWT
• Debugging expired-session issues — check the exp claim to confirm token validity
• Verifying token structure — confirm the expected alg, typ, and registered claims are present
• Learning JWT anatomy — see how header, payload, and signature are encoded and separated

Technical Details

Standard: RFC 7519 (JWT), RFC 7515 (JWS). Encoding: Base64URL (no padding). Three segments separated by dots. Common algorithms: HS256, RS256, ES256. The exp claim is a Unix timestamp in seconds. Signature verification is NOT performed — never use a decoded token as proof of authenticity. Display the decoded header and payload as pretty-printed JSON.