What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is a compact, URL-safe token format used to transmit claims between parties. It is commonly used for authentication: after login, a server issues a JWT that the client includes in subsequent requests to prove its identity. JWTs can be verified without a database lookup because they are cryptographically signed — the server just needs the signing key.

What are the three parts of a JWT?

A JWT consists of three Base64url-encoded parts separated by dots: Header.Payload.Signature. The header specifies the token type and signing algorithm (e.g. 'alg': 'HS256'). The payload contains the claims — data like user ID, expiry time (exp), issued-at time (iat), and any custom claims. The signature is a cryptographic hash of the header and payload using a secret key — it allows the receiver to verify the token was not tampered with.

How do I check if a JWT has expired?

Paste the token into the decoder above. The exp claim is the expiry time as a Unix timestamp — the tool displays it as a human-readable date/time. If the current time is after the exp timestamp, the token is expired. The iat (issued at) claim shows when the token was created, and nbf (not before) shows when it becomes valid.

Is it safe to decode a JWT in the browser?

Yes — decoding only reads the payload; it does not verify the signature. The payload is Base64url-encoded, not encrypted, so anyone who can read the token can decode it. This is by design: JWTs are not secret, they are tamper-proof. This decoder runs entirely in your browser and sends nothing to any server, so your token never leaves your device.

What is the difference between JWT and session cookies?

Session cookies store a session ID that references server-side session data. The server must look up the session in a database or cache on every request. JWTs are stateless — all the data is in the token itself, signed by the server. JWTs scale easily across multiple servers without shared session storage. The tradeoff: JWTs cannot be easily revoked before expiry (unlike sessions), so expiry times should be short for sensitive applications.