What is a JWT?
A JSON Web Token (JWT, said "jot") is a small, signed message that says who someone is and what they're allowed to do, used for logins and API access. It's three parts separated by dots: a header saying how it's signed, a payload of claims, and a signature. The header and payload are only base64url-encoded, not encrypted: anyone who has the token can read them, which is all this decoder does.
Is it safe to paste a token here?
A token is often a live login: whoever has it can act as you until it expires. This page decodes and checks it entirely in your browser, and never sends it anywhere, but be careful with any site that does. When you're done, tokens you've shared can usually be revoked by logging out.
The standard claims
iss is who issued the token, sub who it's about, and aud who it's for.
exp, nbf and iat are when it expires, when it starts being valid and
when it was issued, as Unix timestamps; this page shows them as dates. jti is a unique ID for the
token.
Checking the signature
A signature proves the token wasn't changed since it was signed. Tokens signed with HS256,
HS384 or HS512 use a shared secret: enter it to check. The others (RS,
PS, ES and EdDSA) are checked with the issuer's public key, as a PEM
block or a JWK. Many issuers publish theirs as a JWKS at an address ending in
/.well-known/jwks.json; paste the whole set and the key the token names is used. A token with
"alg": "none" isn't signed at all.