What is the key difference between symmetric (HS256) and asymmetric (RS256) signatures?
HS256 (HMAC with SHA-256) relies on a single shared secret key that both signs and verifies the token. This requires absolute trust between the token issuer and consumer. RS256 (RSA Signature with SHA-256) utilizes a private key to sign the token and a public key to verify it. Anyone with the public key can verify integrity, but only the issuer can generate valid tokens, making it ideal for microservices and third-party APIs.
Can an end-user edit their JWT payload to bypass validation checks?
Users can decode and modify the plaintext payload easily since JWTs are only Base64URL-encoded, not encrypted. However, changing any character in the Header or Payload invalidates the cryptographic Signature. When the backend service performs verification, it hashes the modified content with the secret key, detects the signature mismatch, and rejects the token.
Is my JWT transmitted or saved on the server when I paste it here?
No. Our JWT Decoder performs all token separation, Base64URL decoding, timestamp formatting, and signature verification entirely on your device inside your web browser using HTML5 Web Cryptography APIs and local JavaScript. No token characters, keys, or claims are sent over the network, ensuring complete confidentiality.
How do I convert an expired token timestamp back to standard readable calendar dates?
Standard JWT expirations use Unix epoch seconds (seconds elapsed since January 1, 1970). Our interactive tool automatically translates this integer into ISO-8601 calendar strings and local time relative to your current timezone, so you can visually verify if a token expired five minutes ago or is still valid.
Strict Local Computation: The JWT claims parsing and signature verification execute completely within the client browser. No backend databases or access logs monitor your secure payloads.