JWT Decoder

What is a JWT (JSON Web Token)?

A JWT is a compact, URL-safe token format used for authentication and data exchange. It has three Base64url-encoded parts separated by dots: header (algorithm and token type), payload (claims like user ID, expiry), and signature (created by the server to verify authenticity). Only the server with the secret key can create a valid signature.

Is it safe to decode a JWT in this tool?

Yes. Decoding runs entirely in your browser with no server requests. However, never paste production JWT tokens (session tokens, auth tokens) into any public website. The JWT payload is base64-encoded, not encrypted — anyone with the token can read the claims. Treat a JWT like a password.

Why can this tool decode but not verify a JWT?

JWT signature verification requires the server's secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA like RS256). Without that key, you can read the payload but cannot confirm the signature is authentic. Always verify JWT signatures server-side before trusting any claims.

What are common JWT claims (exp, iat, sub, iss)?

exp (expiration): Unix timestamp when the token expires. iat (issued at): when the token was created. sub (subject): who the token refers to — usually a user ID. iss (issuer): the server that issued the token. aud (audience): who the token is for. nbf (not before): earliest valid time. These are standard registered claims defined in RFC 7519.

What is the difference between HS256, RS256, and ES256?

HS256 (HMAC-SHA256): symmetric — the same secret is used to sign and verify. Simple but verifiers must know the secret. RS256 (RSA-SHA256): asymmetric — signed with a private key, verified with a public key. ES256 (ECDSA-SHA256): asymmetric like RS256 but with elliptic curve cryptography — smaller signatures, faster verification. RS256/ES256 are preferred in distributed systems.

What should I do when my JWT is expired?

An expired JWT should be rejected by your server — the client must request a new token. Common pattern: short-lived access tokens (15 min) paired with long-lived refresh tokens (7-30 days). The refresh token exchanges for a new access token. Never modify the JWT payload to extend expiry — the signature becomes invalid.