JWT Decoder

How to Use

1. Paste your JWT token into the input field (starts with eyJ...).
2. Click Decode to view the header, payload, and signature.
3. Timestamp fields (iat, exp, nbf) are automatically converted to human-readable dates.
4. Click Sample to load an example JWT for exploration.

What Is a JWT?

JSON Web Tokens (JWTs, pronounced "jots") are an open standard (RFC 7519) for creating access tokens that assert claims. They are widely used for authentication and authorization in web applications, APIs, and microservices. A JWT allows a server to issue a self-contained token that clients can present to prove their identity without the server needing to look up session state.

JWT Structure

A JWT consists of three parts separated by dots (.):

Header — Contains the signing algorithm (e.g., HS256, RS256) and token type (JWT). This is Base64url-encoded JSON.

Payload — Contains the claims: data about the user or session. Standard claims include sub (subject), iat (issued at), exp (expiration), and iss (issuer). You can also include custom claims. This is also Base64url-encoded JSON.

Signature — Created by signing the encoded header and payload with a secret key (HMAC) or private key (RSA/ECDSA). The signature ensures the token has not been tampered with.

Common JWT Algorithms

• HS256 (HMAC-SHA256) — Symmetric: the same secret key signs and verifies. Simple but requires secure key sharing.
• RS256 (RSA-SHA256) — Asymmetric: a private key signs, a public key verifies. Ideal for distributed systems where verifiers should not have signing capability.
• ES256 (ECDSA-P256) — Asymmetric with smaller keys and signatures than RSA. Increasingly preferred for new systems.
• EdDSA (Ed25519) — Modern asymmetric algorithm with excellent performance and small signatures.

JWT Security Best Practices

• Always verify the signature server-side before trusting any claims
• Set short expiration times (15 minutes for access tokens) and use refresh tokens for longer sessions
• Never store sensitive data in the payload — it is encoded, not encrypted
• Validate the iss (issuer) and aud (audience) claims to prevent token misuse across services
• Use the alg header carefully — always validate it matches your expected algorithm to prevent algorithm confusion attacks

JWTs in Code

In Node.js, the jsonwebtoken package provides jwt.sign() and jwt.verify(). In Python, use PyJWT: jwt.encode() and jwt.decode(). In Go, the golang-jwt/jwt package is the standard choice. Most frameworks (Express, Django, Spring) have JWT middleware for automatic token validation.

Related Tools

JWTs use Base64 encoding for header and payload. Signatures use SHA-256 hashing. Prettify payloads with the JSON Formatter. Convert JWT timestamp claims with the Epoch Converter. Validate JWT payload structure with the JSON Validator. Encode JWTs for URL parameters with the URL Encoder.