Question 1

What is a JWT (JSON Web Token)?

Accepted Answer

A JWT is a compact, URL-safe token used to transmit claims between parties — most commonly to prove a user is authenticated. It has three base64url-encoded parts separated by dots: a header (which algorithm signed it), a payload (the claims, like user ID and expiry), and a signature that lets the receiver detect tampering.

Question 2

How do I decode a JWT?

Accepted Answer

Split the token at the dots and base64url-decode the first two parts — they are plain JSON. This tool does it instantly: paste the token (a full "Bearer …" Authorization header works too) and the header, payload, and a plain-English explanation of every claim appear immediately.

Question 3

Is a JWT encrypted?

Accepted Answer

No — a standard JWT (JWS) is signed, not encrypted. Anyone who has the token can read the header and payload; the signature only proves who issued it and that it wasn't modified. Never put secrets like passwords in a JWT payload. Encrypted tokens exist (JWE) but are far less common.

Question 4

What is the difference between decoding and verifying a JWT?

Accepted Answer

Decoding just reads the token's contents — anyone can do it, no key required. Verifying checks the cryptographic signature to prove the token was issued by the expected party and hasn't been tampered with. This tool decodes any JWT, and can also verify HS256/HS384/HS512 signatures if you provide the shared secret.

Question 5

Why is my JWT expired or invalid?

Accepted Answer

Most JWTs carry an exp (expiration) claim as a Unix timestamp; servers reject the token after that moment. Paste your token above to see the exp claim converted to your local time with a live countdown. If a fresh token is rejected, also check the nbf (not before) claim and whether your machine's clock is skewed.

Question 6

Is it safe to paste a JWT into an online decoder?

Accepted Answer

This tool decodes and verifies entirely in your browser with JavaScript — the token is never uploaded, stored, or logged, and it works offline. That said, a live production token is a credential: prefer expired or development tokens when debugging, whatever tool you use.

Question 7

What do the JWT claims iss, sub, aud, exp, and iat mean?

Accepted Answer

They are the registered claims from RFC 7519: iss is the issuer that created the token, sub is the subject (usually the user ID), aud is the intended audience, exp is the expiration time, nbf is the earliest valid time, iat is when it was issued, and jti is a unique token ID. This decoder annotates each one inline, with timestamps converted to readable dates.

JWT Decoder

JWT DECODER FAQ