JWT Decoder
Decodifica e analizza JSON Web Token. Visualizza header, payload, verifica scadenza e ottieni descrizioni dettagliate dei claims standard.
Decodifica JWT
Come utilizzare JWT Decoder
Attach your JWT token
Copy your JWT token (a three-part string separated by dots, e.g. eyJhbGci...). Paste it into the text area. Decoding happens in real-time as you type.
Examine Header and Payload
The tool shows the three sections of the token: Header (algorithm and type), Payload (claims with user data, expiration, and issuer), and Signature. Each standard claim is explained.
Check expiration date
If the payload contains the "exp" claim, the tool automatically calculates whether the token is still valid or how long it has expired, displaying a green (valid) or orange (expired) banner.
Copies individual sections
Use the copy buttons next to each section (Header, Payload, Signature) to copy the formatted JSON to your notes, ready for use in other tools.
Load an example token
Click "Example" to load a test JWT token with typical claims (sub, name, email, iat, exp, roles). Useful for exploring features without a real token.
Suggerimenti
- I claim "exp", "iat" and "nbf" are Unix timestamps: the tool automatically converts them into readable Italian dates.
- If you need to test an API that requires JWT authentication, use the "Example" button to generate a valid token for the current hour with example roles.
- Timeline saves automatically the last 10 decoded tokens (no duplicates) for quick access.
Domande frequenti
What is a JSON Web Token (JWT)?
A JWT is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It consists of three parts encoded in Base64URL and separated by dots: Header (algorithm), Payload (data/claims), and Signature (signature to verify integrity).
Does this tool verify your JWT signature?
No, this tool decodes and displays JWT content but cannot verify the cryptographic signature as it requires either the secret key or the server issuer's public certificate. Decoding the payload is secure and doesn't require the key; the payload isn't encrypted, only Base64URL encoded.
Is it safe to glue my JWT into this tool?
Yes, all decoding takes place exclusively in your browser: no data is sent to external servers. However, it's a good practice not to share production JWT tokens containing sensitive data on online tools, especially if you're unsure of the source.
What are the most common JWT claims and what do they mean?
Standard claim types are: "iss" (issuer), "sub" (subject, usually user ID), "aud" (audience), "exp" (expiration, Unix timestamp), "iat" (issue time), "nbf" (not before this date), "jti" (unique token ID). Personalized claims like name, email and roles depend on the application.
How do I know if my JWT token has expired?
Attach the token to the tool: if it contains the "exp" claim, a banner will automatically appear indicating whether the token is valid with remaining time until expiration or how long it has expired. The "exp" claim in the payload is also highlighted with readable Italian date.