What a JWT is
A JSON Web Token (JWT, said "jot") is a compact way to pass a set of facts between two systems, such as "this request comes from user 42 and is allowed to read their notes". It's most often sent in an Authorization: Bearer header or stored in a cookie after you sign in.
The three parts
A JWT is three base64url strings joined by dots: header.payload.signature.
- Header: which algorithm signed the token (
alg), usually a type (typ) and sometimes a key ID (kid). - Payload: the claims, a JSON object with whatever the issuer chose to put in it.
- Signature: computed over the first two parts with a secret or a private key, so any change to them breaks it.
Base64url is an encoding, not encryption. Anyone holding the token can read the payload, so it should never contain anything you'd mind the holder seeing.
Registered claims
RFC 7519 defines a few claim names with fixed meanings. All are optional.
iss(issuer): who created the token, often your auth server's URL.sub(subject): who the token is about, usually a user ID.aud(audience): which service the token is meant for. A server should reject tokens for someone else.exp(expiry): the time after which the token must be refused.nbf(not before): the time before which it must be refused.iat(issued at): when it was created.jti(JWT ID): a unique ID, useful for revoking one token or spotting replays.
Times are NumericDate values: whole seconds since 1 January 1970 UTC. This tool shows them as dates in your own time zone and tells you how far away they are. OpenID Connect adds auth_time, when the person actually signed in, which is shown too.
Decoding is not verifying
Reading a token proves nothing about it. Anyone can write a JSON object, encode it and attach a made-up signature. A token is only trustworthy once the signature checks out against the right key and the claims make sense for your service: the issuer and audience match and the times are in range.
To check a signature here, enter the shared secret for HS256, HS384 or HS512, or paste the issuer's public key (PEM or JWK) for RSA, RSA-PSS, ECDSA and EdDSA tokens. Both run with your browser's WebCrypto. Many providers publish their public keys at a JWKS URL; you can paste the whole key set and the key matching the token's kid is picked.
Two classic mistakes
alg: none
The JWT spec allows unsigned tokens with "alg": "none" and an empty signature. A server that reads alg from the token and trusts it can be handed a token with any claims and no signature at all. Your verifier should only accept the algorithms you expect.
Mixing up HS and RS
With RS256 the server verifies with a public key that anyone can download. If the library also accepts HS256 and uses "the key" for both, an attacker can sign a token with HMAC using that public key as the secret, and it will pass. The fix is the same: pin the algorithm per key, and use a library that refuses to mix them.
FAQ
Is it safe to paste my JWT here?
The token never leaves your browser: decoding and signature checks run in JavaScript on this page, with no network requests and nothing saved. Still, a live token is a password for as long as it's valid. Prefer expired or test tokens, and don't paste production tokens into sites you don't trust.
Can you decode a JWT without the secret?
Yes. The header and payload are only base64url-encoded, not encrypted, so anyone holding the token can read them. The secret or public key is needed only to check the signature, which proves who issued the token and that nobody changed it.
Why does my token say expired?
The exp claim is in the past compared with your device's clock. Access tokens are often short-lived (5 to 60 minutes), so a token copied earlier may simply have run out. If it looks wrong, check your clock, and check that exp is in seconds: a 13-digit value is milliseconds and is a bug in whatever issued it.
What's the difference between HS256 and RS256?
HS256 signs with one shared secret: whoever can verify a token can also create one. RS256 signs with a private key and verifies with a public key, so services can check tokens without being able to mint them. ES256 works like RS256 with a smaller elliptic curve key.
Does Valid by time mean the token is valid?
No. It only means the current time is between nbf and exp. A server also checks the signature, the issuer, the audience and often whether the token was revoked. Use the signature section to check the first of those.