Comprehensive architectural guide to JSON Web Tokens (JWT). Learn token anatomy, Base64URL decoding, signature verification, and client-side inspection.
Frequently Asked Questions
Q1. Are JWT tokens encrypted?
No! Standard JWTs (JWS) are signed and Base64URL encoded, NOT encrypted. Anyone who intercepts a JWT can decode the payload string and view user claims. Never put passwords or API secrets in a JWT payload.
Q2. How do I check if a JWT token is expired?
Decode the payload JSON and check the "exp" (expiration) claim, which contains a Unix timestamp in seconds. If the current time exceeds "exp", the token is expired.
Q3. Why should I decode JWTs on the client side using DevToolAdda?
Decoding JWTs locally in your browser ensures that sensitive authorization bearer tokens, session IDs, or user metadata are never transmitted to third-party servers.