What is a JSON Web Token (JWT)?
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. A JWT consists of three Base64Url-encoded segments separated by dots: the Header (algorithm & token type), the Payload (claims and data), and the Signature (cryptographic verification). JWTs are the dominant standard for stateless API authentication, OAuth 2.0 flows, and Single Sign-On (SSO) systems.
How to Read JWT Claims — iat, exp, iss, sub, aud
The JWT payload contains registered claims that have specific meanings. sub (subject) identifies the user or entity the token represents — typically a user ID. iss (issuer) is the server or service that created the token. aud (audience) specifies which service or API should accept it. iat (issued at) is a Unix timestamp of when the token was created. exp (expiration) is the Unix timestamp after which the token is no longer valid. Paste your token into our decoder to instantly read all these values in human-readable JSON.
HS256 vs RS256 — What Does the JWT Algorithm Mean?
The JWT header contains an alg field specifying the signing algorithm. HS256 (HMAC-SHA256) uses a shared secret key — both the issuer and verifier must know the same secret. It is common in monolithic applications. RS256 (RSA-SHA256) uses a public/private key pair — the issuer signs with a private key and verifiers authenticate using the public key. This is the standard for microservices, API gateways, and multi-tenant systems. Our JWT decoder extracts and displays the alg, typ, and kid (key ID) fields from the header for instant inspection.
Detect Expired JWT Tokens Instantly
A common debugging scenario is pasting a JWT that is being rejected by your API with a "token expired" or "401 Unauthorized" error. Paste the token here to instantly see the exp claim — which is a Unix epoch timestamp. Compare it against the current time: if exp is in the past, your token has expired and you need to refresh it. Use our built-in "Expired Token" example to see exactly what an expired payload looks like and practice identifying the expiry date.
Inspect Role-Based Access Control (RBAC) in JWT Payloads
Modern applications embed access control directly inside JWT payloads using custom claims. Common patterns include a roles array (e.g., ["admin", "moderator"]), a permissions object with resource-level CRUD rights, a scope string for OAuth2 scopes (e.g., "read:users write:posts"), and tenant or organization identifiers for multi-tenant SaaS systems. Our JWT Decoder beautifully formats nested objects and arrays, making it easy to audit complex authorization payloads.
Are JWT payloads encrypted? Is it safe to decode online?
A common misconception is that JWTs are encrypted and therefore hide data. Standard JWTs are cryptographically signed to prevent tampering, but the payload is only Base64Url encoded — anyone who intercepts the token can read the data inside it. Never place passwords, card numbers, or sensitive PII inside a JWT payload. Because this decoder runs 100% locally in your browser using client-side JavaScript, your tokens are never sent to any server, making it completely safe to decode even your production access tokens here.