About JWT Tool
JWT tool decodes tokens, inspects header and payload, verifies signatures and creates test JWTs. Useful for debugging login sessions, OAuth/OIDC flows, API authentication and expiration issues.
How to Use
- Paste a JWT token
- Inspect header, payload and signature sections
- Enter secret or public key to verify the signature
- Create a new test token when needed
Frequently Asked Questions
- Is decoding a JWT the same as verifying it?
- No. Decoding only reads Base64URL content. Verification requires the correct secret or public key to prove the token was not tampered with.
- Can I store sensitive data in JWT payload?
- Usually no. A normal signed JWT is encoded, not encrypted. Anyone with the token can read its payload.
- How do I check expiration?
- The exp claim is a Unix timestamp. The tool can show the readable time, but servers should also validate exp, iss, aud and related claims.