JWT Decoder
Decode and analyze JSON Web Tokens (JWT). Inspect header, payload, and signature components with syntax highlighting and timestamp validation.
Verification:
To verify this signature, you would need the secret key or public key (for RS256) that was used to sign the token. This tool cannot verify the signature as it runs entirely in your browser and does not have access to the signing key.
How to Use the JWT Decoder
- Paste your JWT token into the input field (or click "Sample JWT" to see an example).
- Click "Decode Token" to analyze the JWT components.
- View the decoded header, payload, and signature in the tabs below.
- For tokens with expiration claims (exp), the tool will show if the token is valid, expired, or about to expire.
- Use the copy buttons to copy individual components or the entire decoded token.
About JSON Web Tokens (JWT)
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.
JWT Structure
A JWT consists of three parts separated by dots (.):
- Header - Contains the type of token and the signing algorithm being used
- Payload - Contains the claims or the JWT's data
- Signature - Used to verify that the sender of the JWT is who it says it is and to ensure the message wasn't changed along the way
Common JWT Claims
iss(Issuer) - Identifies the principal that issued the JWTsub(Subject) - Identifies the principal that is the subject of the JWTaud(Audience) - Identifies the recipients that the JWT is intended forexp(Expiration Time) - Identifies the expiration time on or after which the JWT must not be acceptednbf(Not Before) - Identifies the time before which the JWT must not be acceptediat(Issued At) - Identifies the time at which the JWT was issuedjti(JWT ID) - Provides a unique identifier for the JWT
Common Use Cases for JWT
- Authentication - Once a user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token
- Information Exchange - JWTs are a good way of securely transmitting information between parties because they can be signed
- Authorization - JWTs can contain claims about the permissions of a user, allowing fine-grained access control
- Federated Identity - JWTs are used in single sign-on (SSO) scenarios to share identity information across different domains
Frequently Asked Questions
JWT (JSON Web Token) is the base token format. JWS (JSON Web Signature) is a signed JWT, which is what most people refer to when they say "JWT". JWE (JSON Web Encryption) is an encrypted JWT where the claims are encrypted rather than just signed, providing an additional layer of security.
JWT security depends on how it's implemented. JWTs are signed to prevent tampering, but they're not encrypted by default (unless using JWE). The information in a standard JWT can be read by anyone, so sensitive data should not be stored in the payload unless it's encrypted. Always use HTTPS when transmitting JWTs and implement proper token validation, including checking the signature and expiration time.
For web applications, store JWTs in HttpOnly cookies with the Secure flag enabled (when using HTTPS) to prevent XSS attacks. Avoid storing JWTs in localStorage or sessionStorage as they are accessible by JavaScript and vulnerable to XSS attacks. For mobile applications, use secure storage mechanisms provided by the platform.
Common JWT signing algorithms include:
- HS256 (HMAC with SHA-256) - Symmetric algorithm using a shared secret
- RS256 (RSA Signature with SHA-256) - Asymmetric algorithm using a private/public key pair
- ES256 (ECDSA using P-256 and SHA-256) - Asymmetric algorithm using elliptic curve cryptography
- PS256 (RSASSA-PSS using SHA-256 and MGF1 with SHA-256) - Asymmetric algorithm with additional security features
RS256 is often recommended for production environments as it uses asymmetric keys, allowing the token to be verified without exposing the signing key.
No, this tool cannot verify JWT signatures because it would require access to the secret key or public key that was used to sign the token. The tool runs entirely in your browser and does not have access to these keys. It can only decode and display the contents of the JWT.
{
"@context": "https://schema.org",
"@type": "SoftwareApplication",
"name": "JWT Decoder",
"applicationCategory": "DeveloperApplication",
"operatingSystem": "Any",
"offers": {
"@type": "Offer",
"price": "0",
"priceCurrency": "USD"
},
"description": "Free online tool to decode and verify JSON Web Tokens (JWT). Analyze header, payload, and signature components with syntax highlighting.",
"aggregateRating": {
"@type": "AggregateRating",
"ratingValue": "4.8",
"ratingCount": "156"
}
}