JWT Decoder — Decode JSON Web Tokens

Inspect JSON Web Tokens before trusting them

A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. JWTs are widely used for authentication and authorization in modern web apps — they are the standard format for bearer tokens issued by OAuth and OpenID Connect servers. A JWT has three parts separated by dots: a header (which algorithm was used to sign), a payload (the actual claims), and a signature (a cryptographic check that the token has not been tampered with).

The Lintify JWT decoder reads the header and the payload of any JWT. Decoding is not the same as verifying — anyone can decode a JWT, because the header and payload are just base64url-encoded JSON. The signature is what proves the token was issued by someone who has the secret (for HS256) or the private key (for RS256). Lintify does not verify the signature, because that requires the secret or public key and depends on the algorithm declared in the header.

Reading the standard claims

The JWT specification (RFC 7519) defines a small set of standard claims that you will see in almost every token.iss is the issuer — who issued the token.sub is the subject — who the token is about, usually the user ID. aud is the audience — who the token is intended for. exp is the expiry time. nbf is the not-before time. iatis the issued-at time. jti is a unique identifier for the token. Lintify shows the human-readable form of the timestamp claims next to the raw epoch values.

Decoding vs verifying

Decoding a JWT means reading the header and payload. Anyone with the token can do this — the header and payload are not encrypted, only base64url-encoded. This is by design: the recipient needs to read the claims to decide what to do with the token. The signature is what proves that the token was issued by someone with the secret or private key.

Verifying a JWT means checking the signature against the header and payload. For HS256, this requires the shared secret. For RS256, this requires the public key of the issuer. Lintify does not verify signatures because it does not have your secret. Use a library like joseor jsonwebtoken in your server code to verify tokens before trusting them.

Is it safe to paste a real JWT here?

Yes, because all decoding happens in your browser and nothing is sent to a server. That said, JWTs often carry sensitive claims — user IDs, email addresses, scopes. Be careful about screenshots and screen shares when you are showing a real production token to someone else. If you would not be comfortable printing the token on paper and handing it to a stranger, do not show it on a screen share.