🔐JWT Decoder

How to Decode JWT Tokens?

1. Paste your JWT token in the Token text area.
2. Click Decode to extract header and payload.
3. View the decoded header and payload in JSON format.
4. Click Copy Header or Copy Payload to copy specific parts.
5. Note: Signature verification is not performed (requires secret key).

How to Use This JWT Inspector

The Engineering Guide to JSON Web Tokens (RFC 7519)

A JSON Web Token (JWT) is an open industry standard (RFC 7519) used for securely transmitting claims between two parties in modern distributed web architectures and microservices. A compact JWT consists of three parts separated by periods (.):

header.payload.signature

1. The Header

The header contains the cryptographic metadata specifying how the token is signed:

• alg: The cryptographic hashing algorithm used, such as HS256 (HMAC with SHA-256), RS256 (RSA Signature with SHA-256), or ES256 (ECDSA).
• typ: The token media type, which is typically JWT.
• kid (Optional): Key ID indicating which public key from a JSON Web Key Set (JWKS) should be used for signature validation.

2. The Payload (Claims)

The payload contains the "claims" — statements about an entity (typically the authenticated user) and additional session context. RFC 7519 defines several standard registered claim names:

3. The Cryptographic Signature

The signature is calculated by taking the Base64URL-encoded header, appending a period, the Base64URL-encoded payload, and signing that string with a secret key (symmetric) or private key (asymmetric):

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secretKey
)

Critical JWT Security Best Practices

• JWTs are NOT Encrypted: A standard JWT is signed and Base64-encoded, NOT encrypted. Any client, proxy, or intermediary can decode and read the payload. Never store confidential secrets, plaintext passwords, or credit card numbers in a JWT.
• Mitigate the alg: "none" Exploit: Ensure your server-side verification library strictly enforces an explicit algorithm whitelist (e.g. algorithms: ['HS256'] or ['RS256']) and never trusts an unsigned token with "alg": "none".
• Defend Against XSS with HttpOnly Cookies: Storing authentication JWTs in browser localStorage exposes them to Cross-Site Scripting (XSS) attacks. Store tokens in HttpOnly, Secure, SameSite=Strict cookies whenever possible.
• Short Token Lifespans: Access tokens should expire quickly (e.g. 15 minutes), paired with a secure refresh token rotation strategy.

Backend JWT Verification Code Examples

Node.js (jsonwebtoken)

const jwt = require('jsonwebtoken');

const token = req.headers.authorization?.split(' ')[1];
const secretKey = process.env.JWT_SECRET;

try {
  // Verifies signature, exp timestamp, and algorithm simultaneously
  const decoded = jwt.verify(token, secretKey, {
    algorithms: ['HS256'],
    issuer: 'https://auth.example.com',
  });
  console.log('Authenticated User ID:', decoded.sub);
} catch (err) {
  console.error('Invalid token:', err.message);
}

Python (PyJWT)

import jwt
import os

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6..."
secret_key = os.environ.get("JWT_SECRET")

try:
    payload = jwt.decode(
        token,
        secret_key,
        algorithms=["HS256"],
        options={"require": ["exp", "iss", "sub"]}
    )
    print("User ID:", payload["sub"])
except jwt.ExpiredSignatureError:
    print("Token has expired")
except jwt.InvalidTokenError:
    print("Invalid token signature or claims")

Frequently Asked Questions

Is it safe to paste my JWT into this online decoder?

Yes. This tool operates 100% client-side inside your browser engine. The token string is decoded via JavaScript Base64URL parsing and is never transmitted across the network. However, as an engineering safeguard, you should never expose tokens with sensitive production permissions on any third-party computer.

Why doesn't this tool verify the signature?

Cryptographic signature verification requires knowledge of the private cryptographic key (for asymmetric algorithms like RS256) or the shared server secret (for symmetric algorithms like HS256). Because you should never disclose your secret keys to a public browser interface, verification must always take place on your secure server backend.

How do I know if a JWT is expired?

Inspect the exp claim in the decoded payload. The value is a standard Unix timestamp representing seconds elapsed since January 1, 1970. If this number is smaller than the current Unix epoch timestamp (Math.floor(Date.now() / 1000)), the token is expired.

What is the difference between HS256 and RS256?

HS256 (HMAC with SHA-256) is a symmetric algorithm where the exact same shared secret is used to both create and verify tokens. RS256 (RSA Signature with SHA-256) is an asymmetric algorithm where the authentication server uses a private key to sign tokens, and client services verify tokens using a freely distributed public key.

Can a user alter the claims in their JWT?

A user can decode and modify the payload on their computer, but doing so alters the byte sequence. When the modified token is submitted to the backend API, the cryptographic signature check will fail because the user does not possess the secret key needed to re-sign the modified data.

What is the difference between an ID Token and an Access Token?

In OpenID Connect (OIDC) and OAuth 2.0 architectures, an ID Token is consumed by the client application to obtain user profile information (e.g. name, email). An Access Token is presented in HTTP headers to grant authorized access to protected backend API resources.