How do I use the JWT decoder?
- Copy the token from your app, cookie or Authorization header.
- Paste it into the token box.
- Press Decode token and check the claims and expiry.
JWT decoder: frequently asked questions
Does this verify the JWT signature?
No. Verifying needs the secret or public key, which should stay on your server. This tool only reads the contents.
Is it safe to paste a production token?
The tool runs in your browser and sends nothing, but treat live tokens like passwords and prefer expired or test tokens.
What is a JWT?
A JSON Web Token: a signed token with a header, a payload of claims and a signature, used for sign-in sessions and APIs.
Does decoding a JWT verify it?
No. Decoding just reads the Base64 parts. Verification needs the secret or public key and must happen on your server.
Is it safe to paste a JWT here?
Decoding happens in your browser, but a live token is a credential. Prefer expired or test tokens.
What do exp, iat and nbf mean?
Expiry time, issued-at time and not-before time, as Unix timestamps.
Can JWT payloads contain secrets?
They should not. Anyone holding the token can read the payload.
Why is my token rejected?
Common reasons are expiry, a wrong audience or issuer, clock skew or a signature made with a different key.
What is the difference between HS256 and RS256?
HS256 uses one shared secret; RS256 signs with a private key and verifies with a public key, which suits multiple services.
Should I store JWTs in localStorage?
For browser sessions, secure HTTP-only cookies are generally safer because scripts cannot read them.