JWT Decoder

How to Use the JWT Decoder

1. Paste your JWT token into the input area above. The token should have three parts separated by dots.
2. View the decoded header and payload - the header shows the algorithm and token type, the payload shows all claims and data.
3. Check expiration - if the token contains exp, iat, or nbf claims, the Time Claims section shows human-readable dates and whether the token is expired.
4. Switch to Raw Parts mode to see the original Base64url-encoded parts of each section.

Understanding JSON Web Tokens

JSON Web Tokens (JWTs, pronounced "jots") are an open standard (RFC 7519) for securely transmitting information between parties as a compact, self-contained JSON object. JWTs are widely used in modern web applications for authentication, authorization, and information exchange. When a user logs in, the server creates a JWT containing the user's identity and permissions, signs it with a secret key, and returns it to the client. The client includes this token in subsequent requests, and the server verifies the signature to authenticate the request.

JWT Structure

A JWT consists of three parts separated by dots (.):

• Header - contains the token type ("typ": "JWT") and the signing algorithm ("alg": "HS256", "RS256", etc.)
• Payload - contains the claims, which are statements about the user and additional metadata. Standard claims include sub (subject), iss (issuer), exp (expiration), iat (issued at), and aud (audience)
• Signature - created by signing the encoded header and payload with the secret or private key using the specified algorithm

Common JWT Claims

• sub (subject) - identifies the principal that is the subject of the JWT, typically a user ID
• iss (issuer) - identifies who issued the JWT
• aud (audience) - identifies the recipients the JWT is intended for
• exp (expiration time) - Unix timestamp after which the token must not be accepted
• iat (issued at) - Unix timestamp when the token was created
• nbf (not before) - Unix timestamp before which the token must not be accepted
• jti (JWT ID) - unique identifier for the token, useful for preventing token replay

Security Considerations

While JWTs are convenient, they come with security considerations. Never store sensitive information in the payload, as it is only Base64-encoded and not encrypted - use our Base64 Encoder to inspect the raw encoding. Always verify the signature on the server side before trusting a token's claims. Use short expiration times and refresh tokens to limit the window of compromise if a token is stolen. Consider using the HttpOnly and Secure cookie flags when storing JWTs in cookies to prevent XSS attacks.

JWT vs. Session Tokens

Traditional session-based authentication stores session data on the server and sends only a session ID to the client. JWTs are self-contained: all necessary information is encoded in the token itself, eliminating the need for server-side session storage. This makes JWTs ideal for stateless APIs, microservice architectures, and cross-domain authentication. However, JWTs cannot be easily revoked before expiration without maintaining a server-side blacklist, which is a trade-off to consider. To format the decoded JSON payload, paste it into our JSON Formatter, or convert exp and iat timestamps with the Timestamp Converter.

How to Use the JWT Decoder

To use the JWT Decoder, paste your JWT token into the input area above. The token should have three parts separated by dots. View the decoded header and payload - the header shows the algorithm and token type, the payload shows all claims and data. Check expiration - if the token contains exp, iat, or nbf claims, the Time Claims section shows human-readable dates and whether the token is expired. Switch to Raw Parts mode to see the original Base64url-encoded parts of each section.

When to Use the JWT Decoder

Use the JWT Decoder when you need to decode and inspect JSON Web Tokens for debugging, security analysis, or when you want to understand the claims and structure of a JWT.

How It Works

The JWT Decoder uses a client-side approach to decode and inspect JWTs. It does not validate JWT signatures or send your JWT token to a server. All operations are performed in your browser, ensuring that your secret and token remain secure.

Tips, Edge Cases, and Limitations

Always verify the signature on the server side before trusting a token's claims. Use short expiration times and refresh tokens to limit the window of compromise if a token is stolen. Consider using the HttpOnly and Secure cookie flags when storing JWTs in cookies to prevent XSS attacks.

Quick reference