Question 1

What is a JWT?

Accepted Answer

A JWT (JSON Web Token) is a compact, URL-safe token used for authentication and information exchange. It consists of three parts: Header, Payload, and Signature, separated by dots.

Question 2

Is it safe to decode JWTs online?

Accepted Answer

Yes, this tool decodes JWTs entirely in your browser using base64 decoding. No data is sent to any server. The payload is just base64-encoded (not encrypted), so anyone can read it.

Question 3

Can this tool verify JWT signatures?

Accepted Answer

No, signature verification requires the secret key or public key. This tool displays the signature portion and its algorithm, but does not verify cryptographic validity.

Question 4

What are common JWT claims?

Accepted Answer

Common claims include: sub (subject/user ID), iat (issued at), exp (expiration), nbf (not before), iss (issuer), aud (audience), and jti (unique token ID).

Question 5

How do I know if a JWT is expired?

Accepted Answer

Check the 'exp' claim in the payload. This tool automatically converts it to a human-readable date and highlights whether the token is expired or still valid.

Question 6

What algorithms are used in JWTs?

Accepted Answer

Common algorithms include HS256 (HMAC-SHA256), HS384, HS512 for symmetric signing, and RS256, RS384, RS512, ES256 for asymmetric (public key) signing.

Question 7

Can JWT payload be encrypted?

Accepted Answer

Standard JWTs encode (not encrypt) the payload, so anyone can decode and read it. For encryption, use JWE (JSON Web Encryption). Sensitive data should never be stored in a JWT payload.

Question 8

What is the difference between JWS and JWE?

Accepted Answer

JWS (JSON Web Signature) provides integrity — the payload is readable but signed. JWE (JSON Web Encryption) provides confidentiality — the payload is encrypted and unreadable without the key.

JWT Decoder

Token Structure

Token Status

Decoded Header

Decoded Payload

Claims Summary

Related Tools