JWT Decoder

A JSON Web Token is a compact, URL-safe token with three Base64URL parts separated by dots: a header, a payload of claims, and a signature. It is widely used for authentication and API access.

It decodes the header and payload for inspection, and if you supply the secret it will also verify HMAC signatures (HS256, HS384, HS512). RSA/ECDSA signatures (RS/ES/PS) need the public key and are not verified here.

Decoding happens on our server over HTTPS and nothing is stored, but a JWT can be a live credential. Do not paste production tokens you would not want seen; prefer expired or test tokens.

exp is the expiry time and iat is the issued-at time, both as Unix timestamps. The tool shows them in a readable form so you can tell if a token is still valid.

A cookie with the HttpOnly and Secure flags is generally safer because it is not readable by JavaScript, reducing exposure to cross-site scripting. localStorage is convenient but any script on the page can read it.

A classic session token is an opaque identifier that the server looks up in its store, while a JWT carries its claims inside the token itself and is verified by signature, so the server need not keep session state.

Accepting whatever algorithm the token claims lets an attacker switch it, for example to none, and bypass verification. A server must fix the expected algorithm rather than trusting the value inside the token.

The nbf (not before) claim is a Unix timestamp before which the token must not be accepted. Along with exp and iat, it defines the window during which the token is considered valid.

You can decode and edit the payload, but you cannot produce a valid signature without the signing key, so any tampering is detected when the server verifies the token.