- What is a JWT (JSON Web Token)?
- A JWT is a compact, URL-safe token format used to securely transmit information between parties. It consists of three Base64URL-encoded parts separated by dots: a header (algorithm), payload (claims/data), and signature. JWTs are commonly used for authentication and API authorization.
- Is it safe to decode a JWT publicly?
- The header and payload of a JWT are Base64-encoded, not encrypted — anyone who has the token can decode it. Never paste tokens that are still active and contain sensitive data (API keys, PII) into any online tool. Use this decoder for debugging expired tokens or non-sensitive development tokens.
- What are the standard JWT claims?
- Common registered claims include: iss (issuer), sub (subject/user ID), aud (audience), exp (expiration time as Unix timestamp), iat (issued at), nbf (not before), and jti (JWT ID). The exp field is shown as both a timestamp and human-readable date in this decoder.
- Can this tool verify a JWT signature?
- No. Signature verification requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA). Exposing those keys to a browser-based tool would be insecure. This decoder only decodes the header and payload. Use your server-side JWT library (jsonwebtoken, PyJWT, etc.) to verify signatures.
- What does "token is expired" mean?
- If the payload contains an exp (expiration) claim and the current time is past that Unix timestamp, the token is expired and a server should reject it. Expired tokens are valid for debugging and decoding but should not be used for authentication.
- What algorithms are used to sign JWTs?
- The most common are HS256 (HMAC-SHA256, symmetric shared secret), RS256 (RSA-SHA256, asymmetric public/private key pair), and ES256 (ECDSA-SHA256). HS256 is simpler but requires sharing the secret. RS256/ES256 allow the public key to be distributed freely for verification without exposing the signing key.
- What is the difference between JWT and session cookies?
- Session cookies store a session ID server-side and look up user data in a database per request. JWTs are stateless — all user data is encoded in the token itself. JWTs eliminate the database lookup on each request, making them popular for distributed systems and microservices, at the cost of not being revocable without extra infrastructure.