JWT Parser

Yes, when using this tool. All processing is done 100% in your browser. Your tokens are never sent to any server. Please be cautious with other online tools that may send your tokens to their servers.

For HMAC-based tokens (HS256, etc.), you can verify the signature if you have the secret key. For RSA-based tokens (RS256, etc.), you need the public key. Note that this verification is done client-side for your convenience.

A JWT is expired when the current time exceeds the "exp" (expiration) claim in the payload. This tool shows you if a token is expired, active, or not yet valid based on these time claims.

You can modify the payload, but the signature will no longer be valid unless you have the signing key. This is the security mechanism of JWTs - any modification invalidates the signature.

"exp" (expiration) specifies when the token should stop being valid, while "nbf" (not before) specifies when the token starts being valid. For example, you might set "nbf" to create a token that becomes valid in the future.

No! JWT payload is base64 encoded, not encrypted. Anyone can decode and read the contents. Never include passwords, API keys, or other sensitive information in a JWT.

For production applications, use asymmetric algorithms like RS256 or ES256. Avoid using "none" algorithm as it provides no security. HS256 can be used but requires careful secret management.

JWT is designed to be decoded without any special tools. The header and payload are simply base64-encoded JSON. This tool uses JavaScript to decode and display them in your browser. No server communication is needed.