What is a JWT?
A JSON Web Token (JWT) is a text token used by web apps and APIs to prove who a user is after login. It has three dot-separated parts: the header (algorithm), the payload (data such as user ID and expiry) and the signature, which prevents tampering with the first two.
Many people miss this: the header and payload are encoded, not encrypted. Anyone holding the token can read them — exactly what this tool does.
How to use it
- Paste the token (with or without “Bearer”).
- The header and payload are shown as formatted JSON.
- Dates (exp, iat, nbf) are converted to readable dates with the time left or elapsed.
- Review the security notes: alg none, missing expiry, long lifetime, or sensitive data in the payload.
Standard claims
| Claim | Meaning |
|---|---|
iss | who issued the token |
sub | the subject (usually the user ID) |
aud | the app the token is meant for |
exp / nbf / iat | expiry / not before / issued at (seconds since 1970) |
Good security practices for developers
- Always verify the signature on the server and whitelist accepted algorithms — never trust the token’s own alg value.
- Keep access tokens short-lived (minutes to hours) and use refresh tokens when needed.
- Never put passwords, card data or secrets in the payload.
- Treat a token like a password: don’t post it in screenshots or forums.
Decoding happens in your browser; the token is never sent. To compute HMAC signatures, use the hash generator.