This tool is an online JWT (JSON Web Token) decoding tool that helps developers quickly decode the Header, Payload, and Signature parts of JWT Tokens, intuitively displaying claims such as user information, permissions, issuance and expiration times contained in the Token.

What is JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) used to securely transmit information between parties as JSON objects. JWT consists of three parts separated by dots (.): Header.Payload.Signature. It is a self-contained token widely used in scenarios such as user authentication, single sign-on (SSO), and API authorization.

The Three Components of JWT

• Header（头部）：Describes the metadata of the JWT, typically containing two parts: the signing algorithm (alg) and the token type (typ).
• Payload（载荷）：Contains claims, i.e., the actual data to be transmitted between parties, such as user ID, username, permissions, issuance time, expiration time, etc.
• Signature（签名）：The signature of the first two parts, used to prevent data tampering and verify the validity of the Token. A server-side key is required to generate and verify it.

Main Use Cases

• Troubleshoot user login issues by checking whether the Token contains correct permissions and user information.
• Check whether the Token has expired and locate the cause of 401 Unauthorized errors.
• Analyze the contents of ID Tokens returned by third-party services (such as OAuth2, OIDC).
• Quickly verify whether Token generation meets expectations during development and debugging.

Tool Features

• One-click decoding: Paste the Token and click the button to automatically break it down into Header, Payload, and Signature.
• Expiration status detection: Automatically detects whether the Token has expired and provides a prominent status label.
• Timestamp readability: Automatically converts timestamp fields such as iat, exp, and nbf into readable date-time formats.
• Standard field descriptions: Automatically attaches Chinese descriptions to standard claim fields (iss, sub, exp, etc.) in the Payload.
• Safe and reliable: All decoding is performed locally in your browser; your Token is never sent to any server.