Question 1

What is a JWT (JSON Web Token)?

Accepted Answer

A JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe JSON object. JWTs are commonly used for authentication and authorization — a server issues a signed token after login, and the client presents that token on subsequent requests to prove identity.

Question 2

How do I decode a JWT token?

Accepted Answer

Paste your JWT into this JWT Decoder tool. It will split the token at the dots and Base64url-decode the header and payload sections, displaying the JSON contents in a readable format. You can see all claims including expiration time, issuer, and subject without needing a secret key.

Question 3

What are the three parts of a JWT?

Accepted Answer

A JWT consists of three Base64url-encoded parts separated by dots: (1) Header — specifies the token type and signing algorithm (e.g., HS256); (2) Payload — contains the claims, which are statements about the user or session; (3) Signature — verifies that the token has not been tampered with, created using the header, payload, and a secret key.

Question 4

Is it safe to decode a JWT client-side?

Accepted Answer

Yes, decoding the header and payload of a JWT client-side is safe because JWTs are designed to be readable. The payload is only Base64url-encoded, not encrypted. However, you should never share your JWT with untrusted tools or services, as a valid token can be used to authenticate requests. This tool decodes entirely in your browser — no data is sent to any server.

Question 5

How do I check if a JWT is expired?

Accepted Answer

A JWT's expiration is stored in the 'exp' claim in the payload as a Unix timestamp. This decoder automatically compares the 'exp' value against the current time and shows a clear EXPIRED or VALID status. You can also check the 'iat' (issued at) and 'nbf' (not before) claims for the full token validity window.

JWT Decoder

Related Tools