05 // Unicode, Symbol & Encoding WorkbenchJWT-INSPECTOR
JWT (JSON Web Token) Header & Payload Decoder
Splits RFC 7519 JSON Web Tokens on `.` and Base64URL-decodes the JOSE header and claims payload into formatted JSON with expiration status checks.
HEADER
{
"alg": "HS256",
"typ": "JWT"
}PAYLOAD
{
"sub": "user_901",
"role": "admin",
"iat": 1762790400,
"exp": 1794336000
}Was this tool helpful?
Reference Table
- 01Decoding a JWT payload only reads its Base64URL claims — APIs must always cryptographically verify the JWS signature (`RS256`, `ES256`, `EdDSA`, or `HS256`) before trusting any claim!
- 02Standard numeric date claims (`exp`, `iat`, `nbf`) are UTC Unix timestamps in seconds (not milliseconds).
Frequently Asked Questions
How do I check when a JWT expires (`exp`)?+
Look at the `exp` claim in the decoded payload—it stores a Unix epoch timestamp in seconds, which this decoder automatically formats into a human-readable UTC date and checks against the current clock.
Why can anyone read the contents of a signed JWT (JWS)?+
JWS provides integrity and authenticity (tamper-evidence), NOT confidentiality; use encrypted JWE if claims must be hidden from the client.
What is the `alg: none` JWT vulnerability?+
Legacy buggy verifiers accepted unsigned tokens if the attacker changed header `alg` to `'none'`; modern libraries require pinning an explicit allowlist of algorithms.