Question 1

What is a JSON Web Token (JWT)?

Accepted Answer

A JWT is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. They are commonly used for authentication and authorization.

Question 2

Are you logging my JWT tokens?

Accepted Answer

No. Our JWT Decoder parses the token entirely on the client-side using JavaScript. Your token is never transmitted to our servers, keeping your sensitive session data safe.

Question 3

What are the three parts of a JWT?

Accepted Answer

A JWT consists of three parts separated by dots: Header (algorithm and token type), Payload (the data or claims), and Signature (used to verify the token hasn't been altered).

Question 4

Does this tool verify the JWT signature?

Accepted Answer

No, this tool only decodes the Base64-encoded Header and Payload so you can read the data. Verifying the signature requires the private secret key, which should never be exposed to a public tool.

Question 5

How does the tool know if the token is expired?

Accepted Answer

It reads the `exp` (expiration time) claim from the decoded payload. The `exp` value is a Unix timestamp. The tool compares it to your computer's current time to determine if it has expired.

Question 6

Why am I getting an 'Invalid JWT format' error?

Accepted Answer

A valid JWT must have exactly three base64-encoded segments separated by two dots (`.`). Ensure you haven't accidentally copied extra whitespace or missed a portion of the token.

Question 7

Can I edit the JWT payload and re-encode it?

Accepted Answer

Currently, this tool is a decoder only. You cannot forge a valid JWT without the server's private secret key, as altering the payload will invalidate the signature.

Question 8

What is the 'sub' claim in the payload?

Accepted Answer

The `sub` (Subject) claim usually contains a unique identifier for the user or entity that the token belongs to, such as a user ID or email address.

Question 9

What is the 'iat' claim?

Accepted Answer

The `iat` (Issued At) claim is a Unix timestamp that identifies the exact time the JWT was generated by the server.

Question 10

Is it safe to store sensitive data in a JWT?

Accepted Answer

No. The header and payload of a standard JWT are merely Base64 encoded, not encrypted. Anyone who captures the token can decode it and read the data. Sensitive information should never be put in the payload.

JWT Token Decoder

What you get

Frequently asked questions

Related tools

Bcrypt Hash Generator & Verifier

Bulk SHA & MD5 Hash Generator

PGP Encryption & Decryption

Password Strength Analyzer