JWT Payload Decoder
Decode the JWT payload to view all claims and data stored in the token. The payload contains the actual information the token conveys.
JWT Payload Structure
The payload is the second part of the JWT (between the dots) and contains claims:
``json
{
"sub": "1234567890",
"name": "John Doe",
"email": "john@example.com",
"role": "admin",
"iat": 1516239022,
"exp": 1516242622
}
`
Claim Types
| Category | Claims | Description |
|---|---|---|
| Registered | iss, sub, aud, exp, nbf, iat, jti | Standard claims with defined meanings |
| Public | name, email, picture | Commonly used claims (IANA registry) |
| Private | role, permissions, tenant_id | Application-specific claims |
Payload Decoder Implementation
`javascript
function decodeJWTPayload(token) {
const parts = token.split('.');
if (parts.length !== 3) {
throw new Error('Invalid JWT format');
}
const payloadPart = parts[1];
// Base64URL decode
const base64 = payloadPart.replace(/-/g, '+').replace(/_/g, '/');
const decoded = atob(base64);
const payload = JSON.parse(decoded);
// Analyze claims
const analysis = {
raw: payload,
registeredClaims: {},
customClaims: {},
timestamps: {}
};
const registered = ['iss', 'sub', 'aud', 'exp', 'nbf', 'iat', 'jti'];
for (const [key, value] of Object.entries(payload)) {
if (registered.includes(key)) {
analysis.registeredClaims[key] = value;
// Convert timestamps to readable dates
if (['exp', 'nbf', 'iat'].includes(key)) {
analysis.timestamps[key] = new Date(value * 1000).toISOString();
}
} else {
analysis.customClaims[key] = value;
}
}
return analysis;
}
``
Registered Claims Reference
| Claim | Name | Purpose |
|---|---|---|
| iss | Issuer | Identifies token creator |
| sub | Subject | Identifies the user/entity |
| aud | Audience | Intended recipients |
| exp | Expiration | When token becomes invalid |
| nbf | Not Before | When token becomes valid |
| iat | Issued At | When token was created |
| jti | JWT ID | Unique identifier for token |
Best Practices
- Keep payload small (affects token size)
- Never store sensitive data (passwords, secrets)
- Use registered claims when appropriate
- Include only necessary information