JWT Decoder
Inspect JSON Web Tokens locally — header, payload, claims.
Paste token
Good to know
Are JWTs encrypted?
No — JWTs are only Base64-encoded, not encrypted. Anyone with the token can read the contents. The signature only protects against tampering, not against viewing. Never put passwords, banking data, or other sensitive information in the JWT payload.
What is the difference between HS256 and RS256?
HS256 uses a symmetric key (same key for signing and verifying). RS256 uses asymmetric cryptography — private key signs, public key verifies. RS256 is safer for distributed systems: only the issuer needs the secret key.
How can I verify the signature?
You need the issuer's key. The inputfix decoder only decodes, because no keys are transmitted — that protects your data. For server-side verification, use libraries like jose (JS), python-jose (Python), or JJWT (Java).
What do exp, iat, nbf mean?
exp = Expiration Time (token expires). iat = Issued At (creation timestamp). nbf = Not Before (token only valid from this time). All as Unix seconds. The decoder shows expired status automatically.