What is a JSON Web Token?
A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties (RFC 7519). It consists of three Base64url-encoded sections separated by dots: a Header, a Payload, and a Signature.
🔒 Header
Declares the token type (typ) and the signing algorithm (alg), such as HS256, RS256, or ES256.
📦 Payload
Contains claims — statements about an entity. Standard claims include sub, iss, exp, iat, and aud.
✍️ Signature
Created by signing the encoded header + payload with a secret or private key. Validates token integrity.
🛡️ Security Note
JWTs are signed, not encrypted by default. Never store sensitive data in a token unless using JWE (JSON Web Encryption).
Frequently Asked Questions
Is this JWT decoder safe to use with real tokens?
Yes. Decoding is performed entirely in your browser using JavaScript. Your token is never sent to any server. However, as a best practice, avoid using real production tokens in any online tool.
Can this tool verify JWT signatures?
This tool decodes and inspects the token structure and claims. Signature verification requires the secret key or public certificate. We display the raw signature so you can verify it separately.
What algorithms does JWT support?
JWTs support HMAC (HS256, HS384, HS512), RSA (RS256, RS384, RS512), ECDSA (ES256, ES384, ES512), and RSA-PSS (PS256, PS384, PS512). The algorithm is declared in the header's alg field.
Why does my token show as expired?
The exp claim is a Unix timestamp. If the current time is past that value, the token is expired. This is enforced by your auth server at validation time.