Question 1

What is a JWT token?

Accepted Answer

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims between two parties. It consists of three Base64URL-encoded parts: a header, a payload, and a signature, separated by dots.

Question 2

Can I decode a JWT without the secret key?

Accepted Answer

Yes. The header and payload of a JWT are only Base64URL-encoded, not encrypted. You can decode and read them without the secret key. The secret is only needed to verify the signature.

Question 3

Is it safe to paste my JWT token here?

Accepted Answer

Yes. This tool runs entirely in your browser. Your JWT token is never sent to any server — all decoding happens client-side in JavaScript.

Question 4

What does the 'exp' claim mean in a JWT?

Accepted Answer

The 'exp' (Expiration Time) claim identifies the expiration time on or after which the JWT must not be accepted for processing. It is a Unix timestamp (seconds since epoch).

Question 5

What is the difference between 'iat' and 'nbf' claims?

Accepted Answer

'iat' (Issued At) indicates when the token was created. 'nbf' (Not Before) specifies the time before which the token must not be accepted. A token can be issued now but not valid until a future time.

Question 6

What algorithms are commonly used in JWT?

Accepted Answer

Common algorithms include HS256 (HMAC with SHA-256), RS256 (RSA with SHA-256), ES256 (ECDSA with P-256), and PS256 (RSA-PSS with SHA-256). The algorithm is specified in the 'alg' field of the header.

Question 7

What are the three parts of a JWT?

Accepted Answer

A JWT has three parts: the Header (contains algorithm and token type), the Payload (contains claims/data), and the Signature (verifies the token hasn't been tampered with). They are separated by dots.

Question 8

Can a JWT be tampered with?

Accepted Answer

While anyone can decode and modify a JWT's payload, the signature will no longer match. A properly implemented server always verifies the signature before trusting the claims, making tampering detectable.

Question 9

How do I check if my JWT token has expired?

Accepted Answer

Paste your JWT into this decoder. If the token has an 'exp' claim, the tool will automatically show whether it's expired or still valid, along with the exact expiration date and time.

Question 10

What is the 'kid' field in a JWT header?

Accepted Answer

The 'kid' (Key ID) is an optional header parameter that indicates which key was used to sign the token. It's useful when the issuer has multiple signing keys and the verifier needs to know which one to use.

JWT Decoder

JWT Structure and How to Handle Tokens Safely

Frequently Asked Questions

Related Tools

JSON Formatter & Validator

Base64 Encoder/Decoder

Regex Tester

Hash Generator

Sources & References