What a JWT is
A JSON Web Token is three base64url-encoded parts joined by dots: a header saying how it is signed, a payload of claims, and a signature. The crucial thing to understand is that a JWT is signed, not encrypted. The signature lets a server confirm the token was issued by someone holding the secret and hasn't been altered — but anyone who intercepts the token can read every claim inside it, because the payload is merely encoded, not hidden. Never put secrets in a JWT payload.
The registered claims
| Claim | Meaning |
|---|---|
iss | issuer — who created the token |
sub | subject — who the token is about (often a user id) |
aud | audience — who the token is intended for |
exp | expiry — a Unix timestamp after which it is invalid |
nbf | not before — a timestamp before which it is invalid |
iat | issued at — when it was created |
jti | JWT ID — a unique identifier, for revocation lists |
The time claims are Unix timestamps; this decoder renders them as readable dates and tells you whether the token is currently valid.
Why verification matters
A JWT is only trustworthy if its signature checks out against the expected
secret or key. History is full of libraries that got this wrong — most famously
the alg: none attack, where a token declares it is unsigned and a
careless verifier accepts it, and algorithm-confusion attacks that trick a
server into verifying an RSA-signed token with the public key as an HMAC secret.
This tool verifies HS256 (HMAC-SHA-256) tokens when you supply the shared
secret, so you can confirm a token is genuine.
Paste tokens here, not just anywhere
A production JWT is a live credential — pasting one into a random website is handing over whatever access it grants. This decoder runs entirely in your browser: the token and secret are processed locally, never sent to a server, and never written into the URL or browser history. Close the tab and they are gone.
Related tools: the Base64 converter for the encoding underneath, the JSON formatter for the payload, the JSON diff for comparing two decoded payloads, and the Unix timestamp converter for the exp and iat claims.