What is a JWT (JSON Web Token) and how does it work?

A JWT (JSON Web Token) is a compact, URL-safe token format used for securely transmitting information between parties as a JSON object. JWTs consist of three parts separated by dots: Header (contains token type and signing algorithm like HS256 or RS256), Payload (contains claims—statements about the user and additional metadata like expiration time), and Signature (ensures the token hasn't been tampered with). When a user authenticates, the server generates a JWT and sends it to the client. The client includes this token in subsequent API requests (typically in the Authorization header). The server validates the signature to verify authenticity without querying a database. JWTs are stateless, self-contained, and widely used in OAuth 2.0, OpenID Connect, and API authentication.

How do I decode a JWT token using this tool?

Decoding a JWT is simple: paste your token (the long string of characters starting with eyJ) into the decoder input field. The tool automatically splits the token into its three parts and decodes them. The Header section displays the algorithm and token type. The Payload section shows claims like user ID, expiration time, issued at time, and custom data. The Signature section shows the encoded signature (which cannot be decoded without the secret key). The decoder works entirely in your browser—your tokens are not sent to any server, ensuring privacy. Use this tool to inspect token contents, verify claim values, check expiration times, and debug authentication issues.

What are JWT claims and what do they mean?

JWT claims are statements about an entity (typically the user) and additional metadata. Standard claims (registered claims) include: iss (issuer - who created the token), sub (subject - user ID or identifier), aud (audience - intended recipient), exp (expiration time - Unix timestamp), nbf (not before - token invalid before this time), iat (issued at - creation timestamp), and jti (JWT ID - unique identifier). Public claims are custom claims registered with IANA or defined with collision-resistant names. Private claims are custom claims agreed upon between parties for sharing information. For example, a JWT might include claims like user role, permissions, email, or session data. Always validate exp claim to ensure tokens haven't expired and aud claim to verify the token is intended for your application.

Can this tool validate or verify JWT signatures?

This decoder can display and inspect JWT signatures, but full signature verification requires the secret key or public key used to sign the token. The tool shows whether a signature is present and which algorithm was used (HS256, RS256, etc.). To fully verify a signature, you need: for HMAC algorithms (HS256, HS384, HS512), the secret key shared between issuer and verifier; for RSA/ECDSA algorithms (RS256, ES256, etc.), the public key corresponding to the private key used for signing. Never share secret keys publicly or paste them into online tools. For security-critical verification, use server-side libraries in your programming language (like jsonwebtoken for Node.js, PyJWT for Python, or jose for Go) that can validate signatures, check expiration, and verify claims securely.

Why does my JWT start with 'eyJ' - what does that mean?

All JWTs start with 'eyJ' because that's the Base64URL encoding of the string '{"' which begins the JSON header. The header typically starts with object notation containing the algorithm and type, like: header object with alg and typ properties. When this JSON is Base64URL-encoded, it always produces a string beginning with 'eyJ'. This is a reliable way to identify a string as a potential JWT. Similarly, many JWT payloads also start with 'eyJ' because they begin with JSON object notation. If a token doesn't start with 'eyJ', it's likely not a valid JWT or uses a different encoding scheme. The consistent structure makes JWTs easy to recognize and parse programmatically.

What's the difference between symmetric and asymmetric JWT algorithms?

JWT signing algorithms fall into two categories. Symmetric algorithms (HMAC: HS256, HS384, HS512) use the same secret key for both signing and verification. They're fast and simple but require secure key distribution—anyone with the secret can create valid tokens. Use symmetric algorithms when the token issuer and verifier are the same system or tightly coupled services. Asymmetric algorithms (RSA: RS256, RS384, RS512; ECDSA: ES256, ES384, ES512) use a private key for signing and a public key for verification. The private key remains secret with the issuer, while the public key can be safely distributed. Use asymmetric algorithms for distributed systems, microservices, or when multiple parties need to verify tokens but only one should create them. Asymmetric algorithms are more secure for public APIs but slower and more complex.

How do I check if a JWT token has expired?

JWT expiration is determined by the exp claim in the payload, which contains a Unix timestamp (seconds since January 1, 1970 UTC). When you decode a JWT with this tool, look for the exp claim value. Compare this timestamp to the current time—if exp is less than the current Unix timestamp, the token has expired. Most decoder tools automatically display exp as a human-readable date and indicate whether the token is expired. To manually convert Unix timestamp to a date, use online converters or programming languages. Servers should always validate exp claim and reject expired tokens. Some systems include an nbf (not before) claim indicating when the token becomes valid. For security, keep token lifetimes short (15 minutes to 1 hour) and use refresh tokens for extended sessions.

Is it safe to paste my JWT token into this online decoder?

This decoder processes JWTs entirely in your browser using JavaScript—tokens are never sent to any server, ensuring privacy. However, general security best practices apply: never decode production JWTs containing sensitive data on public computers or untrusted networks. Be cautious with tokens containing personally identifiable information (PII), financial data, or sensitive claims. For highly sensitive tokens, use offline tools or command-line decoders on your local machine. Remember that decoding (reading) a JWT is different from verifying it—anyone can decode and read JWT contents since they're Base64-encoded, not encrypted. JWTs provide integrity (via signatures) but not confidentiality. If you need to hide token contents, encrypt the JWT or use encrypted JWE (JSON Web Encryption) instead of plain JWT.

What should I do if my JWT is invalid or malformed?

If the decoder reports an invalid or malformed JWT, check these common issues: Ensure you copied the complete token—JWTs are long and easy to truncate accidentally. Verify the token has exactly two dots separating three parts (header.payload.signature). Check for extra whitespace, line breaks, or special characters introduced during copy-paste. Confirm you're decoding a JWT and not a different token type (like opaque tokens or API keys). Ensure the token hasn't been URL-encoded—decode it first if needed. Verify the token uses standard Base64URL encoding. If the token was passed through multiple systems, check for encoding issues or modifications. For troubleshooting, compare with a sample valid JWT to identify structural differences. If issues persist, the token may be corrupted during transmission or storage—request a new token from the issuer.

Can I create or generate JWTs with this tool?

This tool is designed for decoding and inspecting existing JWTs, not creating new ones. Generating JWTs requires a secret key or private key for signing, which should never be entered into public online tools for security reasons. To create JWTs, use server-side libraries in your programming language: jsonwebtoken or jose for Node.js, PyJWT for Python, jose4j or java-jwt for Java, firebase/php-jwt for PHP, and jwt-go for Go. These libraries handle signing, claim validation, expiration, and security best practices. When generating JWTs: use strong, random secret keys (at least 256 bits for HS256), set appropriate expiration times, include only necessary claims to minimize token size, validate all inputs to prevent injection attacks, and never store sensitive data like passwords in JWTs. Use asymmetric algorithms for distributed systems where multiple services verify tokens.

Free JWT Decoder & Debugger

Decode and debug JWT (JSON Web Token) online for free. Inspect header, payload, and signature of JWT tokens. Validate token structure, verify claims, and debug authentication issues instantly.

JWT Token Input

Paste your JWT token to decode and validate

JWT Token

Validation Status

Enter a JWT token to see validation status

JWT Information

Standard Claims

iss: Issuer - who created the token
sub: Subject - who the token is about
aud: Audience - who the token is for
exp: Expiration time
nbf: Not before time
iat: Issued at time
jti: JWT ID - unique identifier

Security Notes

• Never share JWT tokens in public
• Check expiration times
• Verify the signature in production
• Use HTTPS for token transmission
• Store tokens securely

JWT Decoder FAQ - Common Questions

Find answers to frequently asked questions about JWT tokens, decoding, validation, claims, signing algorithms, security, and troubleshooting authentication issues.

Related Security & Development Tools

Explore more tools in the Security & Development Tools category

UUID Generator

Generate Universally Unique Identifiers (UUIDs) in different versions and formats. Perfect for database keys, API identifiers, and unique references.

Password Generator

Generate secure passwords with custom options including length, character types, and special requirements. Create strong passwords for accounts and applications.

Hash Generator

Generate cryptographic hashes from text input. Supports MD5, SHA-1, SHA-256, SHA-384, and SHA-512 algorithms. Perfect for data integrity and security.

Unix Timestamp Converter

Epoch seconds/milliseconds ↔ human date with timezone.

Regex Tester

Test JavaScript regular expressions with live highlighting and flags.

Cron Parser

Explain cron expressions and list next runs.