Question 1

How do I decode a JWT token online?

Accepted Answer

Paste your JWT string (the three dot-separated parts) into the input box. The decoder instantly splits it into Header, Payload, and Signature sections and displays each part as formatted, colour-coded JSON. All standard claims (sub, iss, aud, exp, iat) are parsed and human-readable timestamps are shown for date fields.

Question 2

What is a JWT token and how does it work?

Accepted Answer

A JWT (JSON Web Token) is a compact, self-contained token used to securely transmit data between parties. It has three Base64URL-encoded parts separated by dots: a Header (algorithm and token type), a Payload (claims and data), and a Signature (cryptographic verification). The receiver verifies the signature to ensure the token has not been tampered with.

Question 3

Is it safe to decode a JWT in a browser tool?

Accepted Answer

Yes, for inspection purposes. JWT payloads are only Base64URL encoded, not encrypted - anyone with the raw token string can decode them. Our decoder runs entirely in your browser with zero data sent to any server. However, avoid pasting production tokens with live credentials into any tool you do not trust.

Question 4

What is the difference between HS256 and RS256?

Accepted Answer

HS256 uses a single shared secret (HMAC-SHA256) — the same key signs and verifies. It is simpler but requires the secret to be shared between issuer and verifier. RS256 uses an RSA key pair - the private key signs and the public key verifies. RS256 is preferred for public APIs because the public key can be distributed via JWKS endpoints without exposing the signing key.

Question 5

How do I check if a JWT has expired?

Accepted Answer

Decode the token and look at the exp (expiration) claim in the payload. It is a Unix timestamp (seconds since January 1, 1970). Our decoder automatically converts this to a human-readable date and highlights whether the token is expired or still valid. Compare it to the current time to determine if the token should be rejected.

Question 6

What are the standard JWT claims?

Accepted Answer

iss (issuer) — who created the token. sub (subject) — who the token identifies. aud (audience) — intended recipient service. exp (expiration) — when it expires. iat (issued at) — when it was created. nbf (not before) — earliest valid time. jti (JWT ID) - unique token identifier for revocation tracking.

Question 7

Should I store JWTs in localStorage or cookies?

Accepted Answer

Store tokens in httpOnly, Secure, SameSite cookies - never in localStorage. localStorage is accessible to any JavaScript running on the page, making it vulnerable to XSS attacks. httpOnly cookies are inaccessible to JavaScript and are automatically sent with each request, providing better security by default.

Question 8

What is the difference between a JWT and a session cookie?

Accepted Answer

A session cookie stores a random ID that maps to server-side session data. A JWT is self-contained - all user data and permissions are encoded in the token itself. JWTs are stateless (no server-side storage needed), making them ideal for microservices and horizontal scaling. Session cookies require a shared session store (Redis, database) across all servers.

JWT Decoder & Inspector – Decode JWT Tokens Online

What is a JWT?

JWT Structure

Security Notes

When to Use a JWT Decoder

Frequently Asked Questions

Related Tools

JSON Web Tokens and Modern Authentication

JWT Security Best Practices

Debugging Authentication Flows