Question 1

What is a JWT and what are its three parts?

Accepted Answer

A JSON Web Token (JWT) is a compact, URL-safe string used to represent claims between two parties. It consists of three Base64url-encoded segments separated by dots: the Header (algorithm and token type), the Payload (the actual claims — user ID, roles, expiry, etc.), and the Signature (a cryptographic value that proves the token hasn't been tampered with). Only the header and payload are human-readable; the signature requires the secret or public key to verify.

Question 2

Does this tool verify the JWT signature?

Accepted Answer

No. Signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms like RS256, ES256). This tool only decodes and displays the header and payload. To verify a JWT signature, use your server-side JWT library with the appropriate key.

Question 3

Is it safe to paste my JWT here?

Accepted Answer

All decoding happens entirely in your browser — the token is never sent to any server, stored, or logged. That said, JWTs often contain sensitive user data (user IDs, email addresses, roles). As a general security practice, avoid pasting production tokens into any online tool. Use a test or expired token for debugging.

Question 4

What are the standard JWT claims shown in the summary?

Accepted Answer

The RFC 7519 standard defines seven registered claims: iss (issuer — who created the token), sub (subject — who the token is about), aud (audience — who should accept it), exp (expiry timestamp), nbf (not-before timestamp), iat (issued-at timestamp), and jti (a unique token ID). All other keys in the payload are custom claims defined by your application.

Question 5

Why does the tool show the token as expired even though I just created it?

Accepted Answer

JWT expiry (exp) is a Unix timestamp in seconds. If your system clock is ahead of the issuing server's clock, or if the token was issued with a short lifetime (common in development), it can appear expired immediately. Check the exp value in the payload against the current UTC time shown by the tool.

JWT Decoder — Inspect & Decode JSON Web Tokens

How to Use

Frequently Asked Questions

Related Tools