JWT Decoder
The JWT Decoder parses and displays the contents of JSON Web Tokens (JWTs). JWTs are used for authentication and information exchange in web applications. A JWT consists of three parts: header, payload, and signature, separated by dots. The header specifies the token type and signing algorithm. The payload contains claims (user data, expiration, issuer). The signature ensures token integrity. This decoder shows the decoded header and payload in readable JSON format.
Formula
JWT structure: header.payload.signature - Header: Base64URL encoded JSON (alg, typ) - Payload: Base64URL encoded JSON (claims) - Signature: HMAC or RSA signature All parts are Base64URL encoded (uses - and _ instead of + and /)
Example
JWT: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIn0.abc123 Decoded Header: {"alg": "HS256", "typ": "JWT"} Decoded Payload: {"sub": "1234567890", "name": "Alice"}
How to Use
- Paste your JWT into the input field
- The decoder automatically parses the token
- Review the decoded header and payload
- Check the expiration and issued-at timestamps
- Never store sensitive data in JWT payloads
Frequently Asked Questions
What is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe token used for authentication and information exchange. It contains a header, payload, and signature. JWTs are commonly used in REST APIs for stateless authentication.
Is decoding a JWT secure?
Decoding a JWT only reads the header and payload, which are Base64 encoded (not encrypted). Anyone can decode a JWT. The signature ensures the token has not been tampered with, but the payload is not confidential. Never put sensitive data in a JWT payload.
What are JWT claims?
Claims are statements about an entity (typically the user). Standard claims include 'sub' (subject/user ID), 'iat' (issued at), 'exp' (expiration), 'iss' (issuer), and 'aud' (audience). Custom claims can include roles, permissions, or any other data.
How long should a JWT be valid?
Short-lived JWTs (15-60 minutes) are recommended for security. Use refresh tokens for longer sessions. The 'exp' claim sets the expiration time. Always validate the expiration on the server side.
Can I verify the JWT signature?
This decoder shows the decoded contents but does not verify the signature. Signature verification requires the secret key (for HMAC) or public key (for RSA/ECDSA). Use a library like jsonwebtoken in Node.js or PyJWT in Python for verification.