What is a JWT?
A JWT (JSON Web Token) is a common format for login tokens. It has three Base64URL parts separated by dots: header.payload.signature. The header names the signing algorithm, the payload holds claims such as the user and the expiry time, and the signature proves the content has not been changed.
How to use
- Paste a JWT on the left (a leading
Beareris fine). The header, payload and expiry status appear on the right. iat(issued at),nbf(not before) andexp(expires) are shown as dates in your time zone.- For HS256, HS384 and HS512, enter the secret to verify the signature.
Example
The token loaded by "Load example" has this payload:
{
"sub": "1234567890",
"name": "Mike",
"role": "admin",
"iat": 1700000000,
"exp": 4102444800
}
It is an HS256 token signed with the secret toolpivo-secret.
FAQ
Is the content of a JWT encrypted?
No. The header and payload are only Base64URL-encoded, so anyone who has the token can read them. Never put passwords or other secrets in the payload. The signature proves the content was not changed; it does not hide it.
Is it safe to paste a token here?
Decoding and verification happen in your browser. The token and the secret are never sent to a server and are not saved in the browser. Still, let production tokens expire after use.
Why can't RS256 be verified?
RS256, ES256 and similar algorithms sign with a private key and verify with the issuer's public key. This tool currently supports HS256, HS384 and HS512, which use the same secret to sign and verify.
What unit is exp in?
According to the JWT standard (RFC 7519), exp, iat and nbf are Unix timestamps in seconds, not milliseconds.