Question 1

Is JWT encrypted?

Accepted Answer

No. A standard JWT (JWS) is signed, not encrypted. The header and payload are Base64url-encoded, which is trivially reversible. Anyone who has the token can read its contents. If you need to hide the payload, use JWE (JSON Web Encryption) instead.

Question 2

Can a JWT be hacked or tampered with?

Accepted Answer

The payload of a JWT can be read by anyone, but the signature prevents undetected tampering. If an attacker modifies the payload, the signature will no longer match the secret or private key, and a properly implemented server will reject the token. Risks arise when servers skip signature verification or use weak secrets.

Question 3

How do I verify a JWT signature?

Accepted Answer

For HMAC-based tokens (HS256, HS384, HS512), re-sign the header.payload string with the shared secret and compare the result to the token's signature. For RSA or EC tokens, use the issuer's public key. This tool supports HMAC verification — enter your secret in the Verify Signature section.

Question 4

What is the exp claim in a JWT?

Accepted Answer

The exp (expiration time) claim is a Unix timestamp (seconds since 1970-01-01 UTC) indicating when the token expires. A server must reject any token whose exp is in the past. This tool automatically detects and highlights expired tokens.

Question 5

What is a JWT token?

Accepted Answer

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It consists of three Base64url-encoded parts separated by dots: a header (algorithm and token type), a payload (claims), and a signature (integrity proof).

Question 6

Is it safe to paste a JWT token here?

Accepted Answer

All decoding and verification happens entirely in your browser using the Web Crypto API. No data is sent to any server. That said, avoid pasting live production tokens when possible.

JWT Decoder & Validator

What is a JWT?

Developer and tester use cases

Frequently asked questions

Related Tools