Guide
About JSON Web Tokens
How a JWT is structured
A JWT is three Base64URL-encoded parts joined by dots: header.payload.signature. The header names the signing algorithm (for example HS256 or RS256). The payload holds the claims: who the token is about, who issued it and when it expires. The signature lets the server detect any tampering.
The header and payload are only encoded, not encrypted. Anyone holding a token can read its contents, which is exactly what this tool does. Never put passwords or other secrets in a JWT payload.
Common registered claims
| Claim | Meaning |
|---|---|
iss | Issuer: who created the token |
sub | Subject: usually the user ID |
aud | Audience: which service should accept it |
exp | Expiry time (Unix seconds) |
nbf | Not valid before (Unix seconds) |
iat | Issued at (Unix seconds) |
jti | Unique token ID, useful for revocation lists |
Security checklist for servers
- Always verify the signature before trusting any claim; decoding alone proves nothing.
- Reject tokens with
alg: none, and pin the algorithms you accept instead of trusting the header. - Check
exp,nbf,issandaudon every request. - Use long, random HMAC secrets (at least 256 bits) or asymmetric keys (RS256/ES256) when several services verify tokens.
- Keep access tokens short-lived and use refresh tokens for long sessions.
Frequently asked questions
Is it safe to paste a production token here?
Decoding and verification run entirely in your browser and nothing is transmitted. Still, a valid token is a credential, so treat it like a password and prefer expired or test tokens when you can.
Why can't I verify an RS256 token?
RS256 and ES256 tokens are verified with the issuer's public key (often published as a JWKS file). This tool currently verifies HMAC (HS256/384/512) signatures, which use a shared secret.
What does 'Expired' mean if my app still accepts the token?
Many servers allow a small clock-skew leeway, typically 30 to 60 seconds. If the token is well past exp and still accepted, the server is not checking expiry and should be fixed.