Question 1

What is a JSON Web Token (JWT)?

Accepted Answer

A JWT is a compact, URL-safe token format used for authentication and authorization. It consists of three base64url-encoded parts separated by dots: a header (algorithm and type), a payload (claims like user ID, expiry, and issuer), and a cryptographic signature that verifies the token has not been tampered with.

Question 2

Is it safe to decode a JWT in the browser?

Accepted Answer

Yes. Decoding a JWT only reveals the header and payload, which are not encrypted — just base64url-encoded. The signature cannot be forged without the secret key. This tool decodes entirely in your browser; no data is sent to any server.

Question 3

Can I verify a JWT signature with this tool?

Accepted Answer

No. Signature verification requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA). Verifying signatures should always happen server-side, never in the browser where secrets would be exposed.

Question 4

What are the standard JWT claims?

Accepted Answer

The registered claims defined in RFC 7519 are: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). Applications often add custom claims like email, name, role, or permissions.

Question 5

How do I check if a JWT is expired?

Accepted Answer

Look at the exp (expiration) claim in the payload. It is a Unix timestamp in seconds. If the current time is past the exp value, the token is expired. This tool automatically checks the exp claim and shows an Expired or Valid badge.

Question 6

What is the difference between HS256 and RS256 in JWTs?

Accepted Answer

HS256 (HMAC-SHA256) uses a shared secret for both signing and verification — both parties must know the secret. RS256 (RSA-SHA256) uses a private key to sign and a public key to verify, so only the issuer needs the private key. RS256 is preferred when multiple services need to verify tokens independently.

JWT Decoder

Related Guides

More Free Tools

Building a SaaS?

JWT Decoder

Related Guides

More Free Tools

Building a SaaS?