Understanding JWTs

What Is a JWT Token?

A JSON Web Token (JWT) is a compact, URL-safe token format defined by RFC 7519. It is used to securely transmit information between parties as a JSON object. JWTs are the backbone of modern API authentication — you'll encounter them in virtually every REST API, OAuth 2.0 flow, and OpenID Connect implementation.

Compact, self-contained token carrying its own claims

Three dot-separated parts: Header.Payload.Signature

Header and payload are Base64URL-encoded JSON — not encrypted

Signature ensures integrity — decoded without it to inspect claims

Stateless: servers don't store session data, the token carries it

Supported by every major programming language and framework

JWT Structure — Header · Payload · Signature

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzEyMyIsIm5hbWUiOiJKYW5lIERvZSIsInJvbGUiOiJhZG1pbiIsImV4cCI6OTk5OTk5OTk5OX0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Token Anatomy

The Three Parts of a JWT

Header

Contains the token type ('JWT') and the signing algorithm used (e.g., HS256, RS256, ES256). Always Base64URL-encoded JSON.

{ "alg": "HS256", "typ": "JWT" }

Payload

Contains the claims — assertions about the user or system. Includes standard claims like sub, iss, exp, iat plus any custom claims your app adds.

{ "sub": "user_123", "email": "user@example.com", "role": "admin", "exp": 1735689600 }

Signature

Cryptographic signature that proves the token hasn't been tampered with. Created by signing the encoded header + payload with the secret or private key.

HMACSHA256(base64UrlEncode(header) + '.' + base64UrlEncode(payload), secret)

RFC 7519

Standard JWT Claims Reference

Registered claims defined in RFC 7519

Claim	Name	Type	Description
`iss`	Issuer	`string`	Identifies the principal that issued the JWT. Typically the auth server URL or application name.
`sub`	Subject	`string`	Identifies the subject of the JWT — usually the user ID or entity the token is about.
`aud`	Audience	`string/array`	Identifies the recipients the JWT is intended for. The receiving party must verify this claim.
`exp`	Expiration	`NumericDate`	The time after which the JWT must not be accepted. Unix timestamp in seconds.
`nbf`	Not Before	`NumericDate`	The time before which the JWT must not be accepted. Useful for delayed-activation tokens.
`iat`	Issued At	`NumericDate`	The time at which the JWT was issued. Used to determine the token's age.
`jti`	JWT ID	`string`	Unique identifier for the JWT. Used to prevent token replay attacks by tracking used tokens.

Tutorial

How to Use the JWT Decoder

Decode and inspect any JWT in three steps

1

Paste Your JWT Token

Copy your JWT token from your browser DevTools, API response, Authorization header, or any source and paste it into the input box.

💡 Look in browser DevTools → Application → Cookies/LocalStorage, or copy the value after 'Bearer ' in your Authorization header.

2

Inspect the Decoded Output

The decoder instantly splits the token into Header, Payload, and Signature sections. Each is displayed as formatted JSON with syntax highlighting.

💡 Focus on the Payload — it contains the actual claims like user ID, roles, permissions, and expiry time.

3

Check Claims & Expiry

Review standard claims like 'exp' (expiration), 'sub' (subject), 'iss' (issuer), and 'aud' (audience). The tool highlights expiry status automatically.

💡 If the token is expired, the 'exp' timestamp will be highlighted in red. Refresh your token if needed.

Features

Everything You Need to Inspect JWTs

Built for developers who need fast, reliable token inspection

Instant Decode

Paste a JWT and see the header, payload, and signature decoded immediately as you type. Zero delay, zero button clicks required.

100% Private & Secure

All decoding happens locally in your browser using JavaScript. Your tokens never leave your device and are never sent to any server.

Expiry Checker

Automatically detects the 'exp' claim and shows whether your token is still valid, expired, or how many seconds remain until expiration.

Pretty JSON View

Payload and header are displayed as beautifully formatted, syntax-highlighted JSON for easy reading and inspection.

One-Click Copy

Copy the decoded header, payload, or full JSON output with a single click for use in your code or documentation.

Signature Status

Clearly shows whether the signature section is present. Decodes without verification so you can inspect any token structure.

Claims Explainer

Identifies and explains all standard JWT claims (iss, sub, aud, exp, nbf, iat, jti) inline so you understand what each field means.

Works Everywhere

Works on Windows, macOS, Linux, iOS, and Android. Any device with a modern browser can decode JWTs instantly.

Use Cases

Why Decode JWT Tokens?

Essential use cases for developers and security engineers

Debug Authentication Issues

Quickly inspect what claims your auth server is sending. Verify the correct user ID, roles, and permissions are being included in the token.

Check Token Expiry

Instantly see whether a token is still valid or has expired. Diagnose 401 Unauthorized errors caused by expired JWTs without guessing.

Security Auditing

Verify that tokens contain expected claims and nothing sensitive is accidentally included in the payload (remember: payload is not encrypted).

API Development & Testing

During API development, decode tokens to confirm your auth middleware is producing correct claims before writing integration tests.

Learning & Education

Understand how JWT authentication works by examining real tokens. Ideal for developers learning OAuth 2.0, OpenID Connect, or JWT-based auth.

Incident Investigation

When investigating a security incident or unexpected behavior, decode the token to understand exactly what permissions were granted to a user.

Real-World Usage

JWT Decoding in Practice

How developers use JWT decoding day-to-day

Backend Dev

Debugging JWT Middleware

Verify that your auth middleware is correctly extracting and validating claims. Check that roles, permissions, and user IDs match expectations.

Inspect 'roles' claim to debug RBAC access control

Frontend Dev

Reading Auth State from Token

Frontend apps often decode JWTs client-side to read user info without making an API call. Verify the payload contains the fields your UI needs.

Decode localStorage token to get user display name

Security

Penetration Testing

Security researchers decode JWTs to analyze claims, check for weak algorithms (e.g., none algorithm), and understand the auth model.

Check 'alg' header for HS256 downgrade vulnerabilities

DevOps

OAuth & SSO Debugging

Inspect ID tokens and access tokens from OAuth 2.0 and OpenID Connect flows to debug SSO integrations and user federation.

Verify 'aud' and 'iss' claims match expected provider

Learning

JWT Training & Demos

Use decoded tokens in training sessions and documentation to illustrate how JWT authentication works in practice with real examples.

Show students the exp claim in a live token

Compliance

Audit & Compliance Review

Compliance teams decode tokens to verify that sensitive PII is not included in JWT payloads and that short expiry times are enforced.

Audit tokens for GDPR-sensitive fields in payload

Algorithms

JWT Signing Algorithms

Understanding the 'alg' claim in the JWT header

HS256Symmetric

HMAC-SHA256

Uses a shared secret key. Fast and simple but the same key signs and verifies — not suitable when multiple parties need to verify.

✓ Internal microservices, single-application tokens

HS384Symmetric

HMAC-SHA384

More secure HMAC variant with a 384-bit hash. Marginal security improvement over HS256 with slight performance cost.

✓ When HS256 is deemed insufficient by security policy

HS512Symmetric

HMAC-SHA512

Highest security HMAC variant with a 512-bit hash. Strongest symmetric option at some performance cost.

✓ High-security internal systems requiring symmetric signing

RS256Asymmetric

RSA-SHA256

Uses a private key to sign and a public key to verify. The public key can be distributed widely — ideal for distributed systems.

✓ OAuth 2.0 providers, Auth0, Okta, Firebase, Keycloak

ES256Asymmetric

ECDSA-SHA256

Elliptic curve variant — smaller key size than RSA with equivalent security. More efficient for resource-constrained environments.

✓ Mobile apps, IoT devices, performance-critical systems

PS256Asymmetric

RSA-PSS-SHA256

RSA with Probabilistic Signature Scheme. More secure than RS256 against certain attacks. Recommended in newer security standards.

✓ FAPI-compliant financial APIs, high-assurance systems

Security

JWT Security Considerations

What developers must know about JWT security

Payload Is Not Encrypted

The JWT payload is Base64URL-encoded, not encrypted. Anyone who has the token can decode and read the payload without a key.

✓ Never store sensitive data (passwords, credit card numbers, SSNs) in a JWT payload. Use JWE (JSON Web Encryption) if confidentiality is required.

Always Verify the Signature

Decoding a JWT is not the same as verifying it. Always verify the signature server-side before trusting the claims.

✓ Use a well-maintained JWT library to verify signatures. Never implement signature verification manually.

Use Short Expiry Times

Long-lived JWTs are a security risk. If a token is compromised, it remains valid until expiry since JWTs are stateless.

✓ Access tokens should expire in 15–60 minutes. Use refresh tokens with rotation for long-lived sessions.

Beware the 'none' Algorithm

The 'alg: none' vulnerability allows attackers to forge tokens by removing the signature entirely if the server accepts unsigned tokens.

✓ Always explicitly whitelist accepted algorithms in your JWT library configuration. Never accept 'none' as a valid algorithm.

Validate All Claims

Don't just verify the signature — validate iss, aud, exp, nbf claims explicitly. A valid signature on a wrong-audience token is still a security issue.

✓ Validate iss (expected issuer), aud (your service ID), exp (not expired), and nbf (not before) on every request.

Transmit Only Over HTTPS

JWTs in Authorization headers are exposed if transmitted over plain HTTP. An attacker intercepting traffic can steal and replay the token.

✓ Always transmit JWTs over HTTPS/TLS. Never send tokens in URL query parameters (logged by servers and proxies).

Comparison

JWT vs Other Authentication Methods

When to use JWTs and when not to

Feature	JWT	Session Cookie	API Key
State Storage	Stateless — client carries state	Stateful — server stores state	Stateless — server stores key
Scalability	Excellent — no shared session store	Requires sticky sessions or Redis	Good — lookup in fast key store
Token Revocation	Hard — requires denylist	Instant — delete from server	Instant — delete from server
Security (Compromise)	Lives until expiry if compromised	Can be revoked immediately	Can be revoked immediately
Cross-Domain / Mobile	Excellent — works everywhere	Complex — CORS and cookie issues	Good — works everywhere
Self-Contained Claims	Yes — claims in token	No — lookup required	No — lookup required
Microservices Auth	Excellent — verify without DB call	Poor — central session store required	Moderate — key store lookup needed
Implementation Complexity	Moderate — refresh token logic	Simple for single-server apps	Simple — straightforward

Complete Guide

The Complete Guide to JWT Tokens

How JWT Authentication Works End-to-End

When a user logs in, the auth server verifies credentials and issues a signed JWT containing the user's identity and permissions. This token is sent to the client, which stores it (typically in memory or localStorage). On every subsequent API request, the client includes the JWT in the Authorization header as 'Bearer <token>'. The API server then verifies the signature using the secret or public key — no database lookup needed. If valid and not expired, the request proceeds. This stateless model is why JWTs are fundamental to microservices, SPAs, and mobile apps.

Why JWT Payload Security Matters

A common misconception is that JWT tokens are encrypted. They are not. The header and payload are Base64URL-encoded, which means anyone who obtains the token can decode and read the contents without any key. This is by design — it allows services to read claims without shared secrets. The signature only proves the token wasn't tampered with. This means developers must never store passwords, credit card numbers, SSNs, or any other sensitive PII in a JWT payload. If you need confidential claims, use JWE (JSON Web Encryption) instead of plain JWT.

Access Tokens vs Refresh Tokens vs ID Tokens

In OAuth 2.0 and OpenID Connect, three distinct JWT types are used. Access tokens authorize API requests — they are short-lived (15–60 min) and contain permission scopes. Refresh tokens obtain new access tokens without re-authentication — they are long-lived, stored securely, and should be rotated on each use. ID tokens are issued by OpenID Connect providers and carry the authenticated user's identity claims (name, email, profile). Each type has different security requirements: access tokens should expire quickly, refresh tokens need secure storage, and ID tokens should only be consumed by the client that requested them (validated via 'aud' claim).

Debugging JWT Issues in Development

The most common JWT debugging scenarios developers face: (1) 401 Unauthorized — the token is expired (check 'exp' claim), the signature verification is failing (key mismatch), or the token is malformed. (2) 403 Forbidden — the token is valid but lacks required claims (check 'roles', 'scope', or 'permissions' claims). (3) Invalid audience — the 'aud' claim doesn't match what the service expects. (4) Clock skew issues — 'nbf' or 'exp' validation fails due to time sync differences between servers (allow a few seconds of leeway). Our decoder lets you instantly inspect all claims to diagnose these issues without writing a single line of code.

JWT in Modern Web Architecture

JWTs have become the default auth mechanism for modern web architectures. In microservices, each service independently verifies the JWT using the public key — eliminating the need for a central auth service on every request. In JAMstack and SPAs, JWTs enable client-side auth state without server-side sessions. In mobile apps, JWTs stored in secure storage survive app restarts. API gateways use JWT validation as a first layer before routing to upstream services. The combination of statelessness, self-contained claims, and cryptographic integrity makes JWTs uniquely suited for distributed systems.

FAQ

Frequently Asked Questions

Everything developers need to know about JWT tokens and decoding

Our decoder processes tokens entirely in your browser using JavaScript — nothing is ever sent to a server. However, as a general security principle, avoid pasting production tokens containing sensitive user data into any online tool. Use test tokens or tokens from development environments for debugging. If you must inspect a production token, use a browser DevTools console: atob(token.split('.')[1]) decodes the payload locally.

More Tools

Related Developer Tools

More free tools for authentication, security, and developer productivity

JWT GeneratorFree

Generate and sign JWT tokens with custom claims, algorithm selection, and expiry settings.

Base64 EncoderFree

Encode and decode Base64 and Base64URL strings used in JWT token segments.

Hash GeneratorFree

Generate MD5, SHA-1, SHA-256, and SHA-512 hashes for passwords and data integrity checks.

JSON FormatterFree

Format, validate, and prettify JSON payloads including decoded JWT claim objects.

UUID GeneratorFree

Generate random UUIDs for use as JWT ID (jti) claims or user identifiers.

Unix Timestamp ConverterFree

Convert Unix timestamps to human-readable dates — essential for reading JWT exp and iat claims.

Start Decoding JWT Tokens

Paste your first token and inspect claims instantly. No account, no cost, no server uploads — completely private.

Decode a JWT Now Browse All Tools

JWT Decoder — Decode JSON Web Tokens Instantly

JWT Decoder

What Is a JWT Token?

The Three Parts of a JWT

Standard JWT Claims Reference

How to Use the JWT Decoder

Paste Your JWT Token

Inspect the Decoded Output

Check Claims & Expiry

Everything You Need to Inspect JWTs

Instant Decode

100% Private & Secure

Expiry Checker

Pretty JSON View

One-Click Copy

Signature Status

Claims Explainer

Works Everywhere

Why Decode JWT Tokens?

Debug Authentication Issues

Check Token Expiry

Security Auditing

API Development & Testing

Learning & Education

Incident Investigation

JWT Decoding in Practice

Debugging JWT Middleware

Reading Auth State from Token

Penetration Testing

OAuth & SSO Debugging

JWT Training & Demos

Audit & Compliance Review

JWT Signing Algorithms

JWT Security Considerations

Payload Is Not Encrypted

Always Verify the Signature

Use Short Expiry Times

Beware the 'none' Algorithm

Validate All Claims

Transmit Only Over HTTPS

JWT vs Other Authentication Methods

The Complete Guide to JWT Tokens

How JWT Authentication Works End-to-End

Why JWT Payload Security Matters

Access Tokens vs Refresh Tokens vs ID Tokens

Debugging JWT Issues in Development

JWT in Modern Web Architecture

Frequently Asked Questions

Related Developer Tools

JWT Decoder — All Topics Covered

Start Decoding JWT Tokens

JWT Decoder — Decode JSON Web Tokens Instantly

JWT Decoder

What Is a JWT Token?

The Three Parts of a JWT

Standard JWT Claims Reference

How to Use the JWT Decoder

Paste Your JWT Token

Inspect the Decoded Output

Check Claims & Expiry

Everything You Need to Inspect JWTs

Instant Decode

100% Private & Secure

Expiry Checker

Pretty JSON View

One-Click Copy

Signature Status

Claims Explainer

Works Everywhere

Why Decode JWT Tokens?

Debug Authentication Issues

Check Token Expiry

Security Auditing

API Development & Testing

Learning & Education

Incident Investigation

JWT Decoding in Practice

Debugging JWT Middleware

Reading Auth State from Token

Penetration Testing