What is a JWT?
A JSON Web Token (JWT, RFC 7519) is a compact way to pass claims between two parties, commonly used for authentication. It has three Base64URL-encoded parts separated by dots:header.payload.signature.
- Header: the token type and signing algorithm, such as
HS256orRS256. - Payload: the claims, such as the user id (
sub), roles and expiry. - Signature: proves the token was issued by someone holding the key and was not modified.
Because the payload is only encoded, never put secrets in a JWT. Anyone holding the token can read it, as this tool shows.
Frequently asked questions
Is it safe to paste my JWT here?
The token is decoded locally in your browser and is never sent anywhere. Still, treat production tokens like passwords: anyone who has a valid token can use it until it expires.
Does this verify the signature?
No. Decoding only reads the header and payload, which are Base64URL-encoded, not encrypted. Verifying a signature requires the secret or public key and should be done by your server.
What do exp, iat and nbf mean?
They are registered claims holding Unix timestamps in seconds: exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.
Can I decode a JWE (encrypted token)?
No. A JWE has five parts and its payload is encrypted, so it can only be read with the decryption key.