Decode and inspect JWT header, payload, and claims instantly. Check token expiry, algorithm, issuer, and all custom claims. Your tokens never leave your browser.
A JWT (JSON Web Token) is a compact, URL-safe token used for authentication and information exchange. It consists of three Base64url-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims — user data and metadata), and the Signature (cryptographic proof of authenticity). The payload contains "claims" like sub (subject/user ID), iat (issued at), exp (expiration time), iss (issuer), and any custom data your application adds.
No. JWT signature verification requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA/ECDSA algorithms). This tool only decodes and displays the header and payload — it does NOT verify the signature. Signature verification must be done server-side using the appropriate key. This tool is useful for inspecting what claims a token contains, checking expiry, and debugging authentication issues.
Standard registered claims include: exp (expiration time — Unix timestamp when the token expires), iat (issued at — when the token was created), nbf (not before — token not valid before this time), sub (subject — typically user ID), iss (issuer — who created the token), aud (audience — who the token is intended for), jti (JWT ID — unique identifier). All time claims are Unix timestamps (seconds since January 1, 1970 UTC).
In ASP.NET Core, use the System.IdentityModel.Tokens.Jwt package: var handler = new JwtSecurityTokenHandler(); var token = handler.ReadJwtToken(jwtString); var claims = token.Claims; var expiry = token.ValidTo;. For validation with signature verification, use handler.ValidateToken() with TokenValidationParameters specifying your secret key, issuer, and audience. In .NET 8+, you can also use Microsoft.AspNetCore.Authentication.JwtBearer for automatic validation in controllers.
When a JWT passes its exp (expiration) timestamp, it becomes invalid. A properly implemented API will reject expired JWTs with a 401 Unauthorized response. The client application must then obtain a new token — typically by using a refresh token (a longer-lived, separate token). This is why JWTs usually have short lifetimes (15 minutes to 1 hour) paired with refresh tokens that last days or weeks. Never extend JWT validity by modifying the token payload without re-signing.