JWT Decoder

A JSON Web Token (JWT) is a compact, URL-safe data structure used to securely transmit identity claims between web systems. A standard signed token consists of three parts separated by periods (.): a Header, a Payload, and a Signature. Each segment is individually encoded using base64url formatting. To convert raw strings or inspect basic variables, use our Base64 Encoder / Decoder. Here is the typical structural representation of a token:

// Standard JWT Token Layout
header_base64url.payload_base64url.signature_base64url

// Example starting with "eyJ"
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.signature

The token header contains metadata about the signature format and target content type. It is decoded from the first base64url segment to identify how the token is signed. If you want to sanitize or format header parameters during code inspections, try our JSON Formatter & Validator. Here is a typical decoded header structure:

// Decoded Header Segment JSON
{
  "alg": "HS256", // HMAC SHA-256 signing algorithm
  "typ": "JWT"    // Token type
}

The payload represents the core claim segment containing user roles, identifier keys, and expiration limits. These parameters are decoded from the second token block. If you are formatting variable formats like camelCase or PascalCase inside API claims, use our Case Converter. Here is a typical decoded payload claim:

// Decoded Payload Segment JSON
{
  "sub": "1234567890", // Subject identifier
  "name": "Jane Doe",
  "admin": true,
  "iat": 1516239022    // Issued at timestamp
}

Modern web tokens include expiration (exp) and issued at (iat) times represented as Unix epoch timestamps. Validation systems check these times to reject expired tokens. If you are converting dates or documenting code structures for developers, try our Markdown to HTML Converter. Here is how expiration is evaluated:

const expTimestamp = 1516239022; // Unix epoch format (seconds)
const isExpired = Date.now() / 1000 > expTimestamp;

if (isExpired) {
  throw new Error("Token verification failed: expired signature");
}

The signature is computed by hashing the encoded header and payload with a secret key or public certificate. Decoding does not require a secret key, but signature verification does. If you are debugging general cryptographic functions, you can test checksum hashes with our Hash Generator. Here is the signature logic:

/* Abstract signature verification formula */
const verification = cryptoSign(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secretKey
);

Standard Base64 strings use characters like + and /, which can cause issues in URL paths. Base64url replaces these with - and _ respectively, and strips the trailing = padding. To encode or decode general parameters for URL structures, use our URL Encoder / Decoder. Here is the padding restoration utility in JS:

function decodeBase64Url(str) {
  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
  while (base64.length % 4) {
    base64 += "=";
  }
  return atob(base64);
}