Question 1

What is a JWT token?

Accepted Answer

Three Base64-encoded parts separated by dots: header.payload.signature. Header says what algorithm was used. Payload has your data (claims). Signature verifies it hasn't been tampered with. Used for authentication in web apps and APIs.

Question 2

How do I decode a JWT?

Accepted Answer

Paste it. The tool decodes it instantly. Strips 'Bearer' prefixes automatically. Shows header, payload, and signature with color-coding. No server involved — all in your browser.

Question 3

Is JWT decoding secure? Is my data safe?

Accepted Answer

Everything happens in your browser. Your token never leaves your device. But JWTs are not encrypted — anyone who has the token can decode it. Don't paste production tokens into online tools. Use this for test tokens only.

Question 4

What's the difference between JWT header and payload?

Accepted Answer

Header: metadata like algorithm (HS256, RS256) and token type. Payload: your actual data (claims) like user ID, expiration, roles. Both are Base64URL-encoded JSON.

Question 5

Why can't I verify the signature?

Accepted Answer

Signature verification needs the secret key (HS256) or public key (RS256). This tool only decodes. In production, verify signatures using JWT libraries with the right keys. Never share secret keys.

Question 6

What does 'none' algorithm mean and why is it dangerous?

Accepted Answer

No signature. Anyone can modify the token and you won't know. Extremely dangerous in production. Attackers can change user IDs, permissions, anything. Always reject 'none' tokens in production. The tool flags this as critical.

Question 7

How do I check if my JWT is expired?

Accepted Answer

Look for the expiration field. If there's an 'exp' claim, you'll see a live countdown like 'Expires in 2h 34m 12s'. Green = valid, yellow = expires soon, red = expired.

Question 8

What are JWT claims and what do they mean?

Accepted Answer

Key-value pairs in the payload. Standard claims: iss (issuer), sub (user ID), aud (audience), exp (expiration), iat (issued at). Custom claims: anything your app needs like roles, email, permissions.

Question 9

Can I compare two JWT tokens?

Accepted Answer

Yep. Compare tab. Paste two tokens. See them side-by-side with differences highlighted. Useful for comparing access vs refresh tokens or before/after changes.

Question 10

What is the difference between ID Token and Access Token?

Accepted Answer

ID Token (OIDC): proves who you are, contains profile info. Access Token (OAuth): grants access to resources, contains permissions. The tool auto-detects which type based on claims.

Question 11

How do I export the decoded JWT?

Accepted Answer

Export as JSON (clean header + payload) or as text report (includes security analysis). Copy individual sections with one click.

Question 12

What are the code examples for?

Accepted Answer

Shows you how to decode JWTs in JavaScript, Python, PHP, Go, C#. Copy-paste ready. Includes both decoding (inspection) and verification (production). Always verify signatures in production.

JWT Decoder

How to Use

Frequently Asked Questions

Related Tools

JSON Formatter

Base64 Encoder/Decoder

Cryptographic Hash & Encoding Toolkit