Question 1

How did JWTs become the standard for web authentication?

Accepted Answer

JWT (JSON Web Token) was published as RFC 7519 in 2015 as a compact, URL-safe way to transmit claims between parties. Every JWT has three Base64-encoded sections separated by dots: a header (algorithm), a payload (claims), and a signature. A common misconception is that JWTs are encrypted — they are only signed, meaning anyone can read the payload by simply Base64-decoding it.

Question 2

Can this tool verify JWT signatures?

Accepted Answer

This tool decodes and displays the token contents but does not verify the cryptographic signature. Signature verification requires the secret key or public key used to sign the token, which should never be shared in a browser tool. Use this decoder to inspect token structure, check claims, and debug expiration issues — then verify signatures on your backend.

Question 3

What do the exp, iat, and sub claims mean?

Accepted Answer

These are standard JWT claims defined in RFC 7519. 'exp' (expiration time) is a Unix timestamp after which the token should be rejected. 'iat' (issued at) records when the token was created. 'sub' (subject) identifies the principal — typically a user ID. This tool automatically checks the exp claim and shows whether the token is still valid or has expired.

JWT Decoder

About this tool

Frequently Asked Questions