Can I decode a JWT without the secret key?
Yes. A signed JWT's header and payload are Base64URL-encoded JSON, so they can be decoded without the secret or public key. The key is needed for signature verification, not for reading the claims. This is why JWT payloads should never contain passwords, API secrets, card data, or other information that must remain confidential.
What is the difference between decoding and verifying a JWT?
Decoding parses the compact token into readable JSON. Verification checks the signature over the original encoded header and encoded payload using the expected algorithm and key. A token can decode successfully and still be forged, expired, aimed at the wrong audience, or signed with the wrong key.
What do exp, nbf, and iat mean in a JWT payload?
exp is the expiration time, nbf is the not-before time, and iat is the issued-at time. All three are NumericDate values measured in seconds since the Unix epoch. This page converts those values into readable UTC timestamps and explains whether the token is expired, not yet valid, or affected by possible clock skew.
Why does my JWT signature fail verification?
Common causes include using the wrong secret or public key, choosing the wrong algorithm, treating a Base64URL-encoded secret as plain text, copying a token with missing characters, changing formatted JSON instead of the original compact signing input, or verifying a token against the wrong issuer's key. For public-key algorithms, also confirm that the kid header points to the key that actually signed the token.
Is HS256 or RS256 better for JWTs?
They solve different deployment problems. HS256 uses one shared secret for signing and verification, so every verifier that can check the token can also create tokens. RS256 uses a private key for signing and a public key for verification, which is often better when many services need to verify tokens without receiving the issuer's private signing key.
What does alg none mean?
alg none means the token is unsecured and has no cryptographic signature. The JWT and JWS specifications allow unsecured tokens for specific use cases, but ordinary authentication and authorization systems should not accept them unless the application has explicitly designed for that mode.
Can this JWT encoder create production tokens?
Use it for fixtures, documentation, tutorials, and local debugging. Production token issuance should happen in your authentication service where keys, issuer policy, expiration policy, audience rules, revocation, and audit logging are controlled. This page signs HMAC test tokens locally and avoids private-key browser signing for asymmetric algorithms.
What is Base64URL and why do JWTs use it?
Base64URL is a URL-safe variant of Base64 that replaces characters such as plus and slash and commonly omits padding. JWT compact serialization uses Base64URL so tokens can travel safely in HTTP headers, URLs, cookies, logs, and configuration text without extra escaping.
Can a JWT decoder tell me whether a token should be accepted by my API?
No decoder can make that full decision by itself. Acceptance depends on server policy: expected issuer, expected audience, allowed algorithms, key rotation rules, clock skew, scopes, token type, revocation state, and application-specific claims. This page helps you inspect and verify the token, but the API must still enforce its own validation rules.
Is it safe to paste a JWT into an online decoder?
It depends on the page and the token. This tool is designed to process tokens locally in the browser, but production tokens can still expose user identifiers, tenant data, scopes, or session context to anyone looking at your screen or browser history. Prefer short-lived test tokens when possible, and avoid pasting live shared secrets into untrusted environments.
