Question 1

What is a JWT token?

Accepted Answer

JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties as a JSON object. It consists of three parts: Header (algorithm and token type), Payload (claims/data), and Signature (verification). JWTs are commonly used for authentication and authorization in web applications and APIs.

Question 2

How do I decode a JWT token?

Accepted Answer

To decode a JWT token, paste it into our decoder tool. The token will be automatically split into its three parts (header, payload, signature) and displayed in readable JSON format. You can see all claims including expiration time, issuer, subject, and custom data without needing to verify the signature.

Question 3

Is it safe to decode JWT tokens online?

Accepted Answer

Yes, our JWT decoder is completely safe because all processing happens in your browser using JavaScript. Your tokens never leave your device or get sent to any server. However, never paste production tokens containing sensitive data into any online tool unless you trust it completely. Use our tool for development and testing purposes.

Question 4

What is the difference between encoding and decoding JWT?

Accepted Answer

Decoding a JWT means reading and parsing an existing token to view its header and payload contents. Encoding (or creating) a JWT means generating a new token by combining a header, payload, and signing it with a secret key. Our tool supports both operations - you can decode existing tokens or create new ones.

Question 5

How do I verify a JWT signature?

Accepted Answer

To verify a JWT signature, you need the secret key (for HMAC algorithms like HS256) or public key (for RSA algorithms like RS256) that was used to sign the token. Enter your token and the secret/key in our tool, and it will verify if the signature is valid. A valid signature confirms the token hasn't been tampered with.

Question 6

What JWT algorithms are supported?

Accepted Answer

Our JWT tool supports the most common algorithms: HS256 (HMAC SHA-256), HS384 (HMAC SHA-384), HS512 (HMAC SHA-512), and RS256 (RSA SHA-256). HS algorithms use symmetric keys (same key for signing and verification), while RS algorithms use asymmetric keys (private key for signing, public key for verification).

Question 7

What information is in a JWT payload?

Accepted Answer

A JWT payload contains claims - statements about an entity (typically the user) and additional data. Standard claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). You can also include custom claims with any data you need to transmit.

Question 8

Can expired JWT tokens still be decoded?

Accepted Answer

Yes! You can decode expired JWT tokens to view their contents. The 'exp' (expiration) claim is just data in the payload - decoding doesn't check expiration. However, when verifying the token for authentication, your application should reject expired tokens. Our tool shows the expiration time and indicates if the token is expired.

JWT Token Encoder & Decoder

Decode JWT Token

Header

Payload

Signature

Token Information

What is JWT?

Header

Payload

Signature