Loading...
Decode JSON Web Tokens client-side: header, payload, human-readable timestamps, expiry status, and optional HS256 signature verification.
RS256/ES256 tokens need the public key and are best verified server-side or with jwt.io-style tooling.
A JSON Web Token is header.payload.signature — two base64url-encoded JSON documents plus a signature. Decoding requires no secret (it's encoding, not encryption) — which is exactly why you should never put sensitive data in a JWT payload.