Free JWT Token Decoder

Yes, JWTs are only signed, not encrypted. The payload is Base64-encoded and readable by anyone. Never put sensitive information (passwords, secrets) in JWT payloads.

This tool decodes the payload for inspection but does not verify signatures. Signature verification requires the secret key or public key, which should never be shared with client-side tools.

The exp (expiration time) claim is a Unix timestamp indicating when the token becomes invalid. If current time exceeds exp, the token is expired and should be rejected.

The three dot-separated parts are: header (algorithm and token type), payload (claims/data), and signature (cryptographic verification). The signature prevents tampering with the header or payload.

HS256 uses a shared secret key for signing and verification (symmetric). RS256 uses a private key for signing and public key for verification (asymmetric). RS256 is better when the verifier should not be able to create tokens.

Yes, all decoding happens locally in your browser. Your JWT is never sent to any server. However, remember that anyone with the token can decode its payload, so never share JWTs publicly.