Frequently Asked Questions

Common questions about JWT Toolkit and JSON Web Tokens — from token structure and claims to security practices and privacy.

Frequently Asked Questions

What is JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It consists of three parts: Header, Payload, and Signature, separated by dots.

How secure is JWT?

JWT security depends on proper implementation. When using strong secrets (for HMAC) or proper key management (for RSA/ECDSA), and when tokens are transmitted over HTTPS, JWTs are very secure. Always validate signatures and check expiration times.

What is HS256?

HS256 (HMAC with SHA-256) is a symmetric algorithm that uses a shared secret to sign and verify JWT tokens. Both the issuer and verifier must have the same secret key.

What is the exp claim?

The "exp" (expiration time) claim identifies the time after which the JWT must not be accepted. It is a NumericDate value representing seconds since Unix epoch (January 1, 1970).

What is the iat claim?

The "iat" (issued at) claim identifies the time at which the JWT was issued. It can be used to determine the age of the JWT and is represented as seconds since Unix epoch.

What is the audience claim?

The "aud" (audience) claim identifies the recipients that the JWT is intended for. Each principal intended to process the JWT must identify itself with a value in the audience claim.

Do you store my tokens?

No, absolutely not. All JWT processing happens entirely in your browser using JavaScript. Your tokens never leave your device, are never sent to our servers, and are never stored anywhere. Your data remains completely private.

What is the difference between HS256 and RS256?

HS256 uses a symmetric algorithm with a shared secret, while RS256 uses asymmetric RSA encryption with a private key for signing and a public key for verification. RS256 is more secure for distributed systems.

Can I use this tool for production tokens?

Yes, but be cautious. While all processing is local and private, avoid pasting production tokens on shared computers or in untrusted environments. For maximum security, use this tool only on your personal device.

What is the sub claim?

The "sub" (subject) claim identifies the principal that is the subject of the JWT. This is typically a user ID or username and must be unique within the issuer's context.

How long should a JWT secret be?

For HS256, use at least 256 bits (32 characters). For HS384, use at least 384 bits (48 characters). For HS512, use at least 512 bits (64 characters). Always use cryptographically random secrets.

What is the iss claim?

The "iss" (issuer) claim identifies the principal that issued the JWT. It is typically a URL or identifier of the authentication server that created the token.

Can JWT tokens be revoked?

JWTs are stateless and cannot be revoked by default. To implement revocation, you need to maintain a blacklist/denylist on the server side or use short expiration times with refresh tokens.

What is the nbf claim?

The "nbf" (not before) claim identifies the time before which the JWT must not be accepted for processing. It is useful for tokens that should only be valid after a certain time.

Should I include sensitive data in JWT?

No. JWT payloads are only Base64URL encoded, not encrypted. Anyone with the token can decode and read the payload. Never include passwords, credit card numbers, or other sensitive data.

What is Base64URL encoding?

Base64URL is a variant of Base64 encoding that is URL-safe. It replaces "+" with "-", "/" with "_", and removes padding "=" characters, making it safe to use in URLs and headers.

How do I verify a JWT signature?

Use our JWT Signature Verifier tool. Enter your token and the secret (for HMAC algorithms) or public key (for RSA/ECDSA). The tool will verify if the signature is valid and the token has not been tampered with.

What happens if a JWT expires?

An expired JWT should be rejected by the verifying party. The application should request a new token, typically using a refresh token mechanism, rather than accepting expired tokens.

Can I edit a JWT token?

You can decode and modify the payload, but any changes will invalidate the signature. To create a valid modified token, you need the secret key to generate a new signature.

Is this tool open source?

JWT Toolkit is built with modern open-source technologies including React, TailwindCSS, and the Web Crypto API. We are committed to transparency and security.

Do I need to install anything?

No installation required. JWT Toolkit runs entirely in your web browser. Just visit the website and start using the tools immediately.

What browsers are supported?

JWT Toolkit works on all modern browsers that support the Web Crypto API, including Chrome, Firefox, Safari, and Edge. We recommend using the latest version of your browser for the best experience.

JWT Tools