JWT Decoder

JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims to be transferred between two parties. Our JWT decoder lets you inspect the contents of JWT tokens by decoding the header and payload components. This is essential for debugging authentication systems, verifying token contents, and understanding how JWTs work.

JWT Structure Explained

A JWT consists of three parts separated by dots: Header, Payload, and Signature. The header contains metadata about the token (like the algorithm used). The payload contains the actual data or claims (like user ID, expiration time). The signature is used to verify that the token hasn't been tampered with.

How JWT Authentication Works

1. User logs in with credentials
2. Server verifies credentials and creates a JWT with user claims
3. Server signs the JWT using a secret key
4. Server sends the JWT to the client
5. Client stores the JWT (usually in localStorage or a cookie)
6. Client includes the JWT in subsequent API requests
7. Server verifies the signature and processes the request

Common JWT Claims

• iss (Issuer): Identifies the principal that issued the JWT
• sub (Subject): Identifies the subject of the JWT (usually user ID)
• aud (Audience): Identifies the recipients that the JWT is intended for
• exp (Expiration): Identifies the expiration time after which the JWT must not be accepted
• nbf (Not Before): Identifies the time before which the JWT must not be accepted
• iat (Issued At): Identifies the time at which the JWT was issued
• jti (JWT ID): Unique identifier for the JWT (used to prevent replay attacks)

Security Warning

⚠️ Important: Never put sensitive information (passwords, API keys, personal data) in JWT payloads. JWT payloads are base64 encoded, not encrypted – anyone can decode them and read the contents. The signature only verifies that the token hasn't been modified, it doesn't hide the payload. Only use JWTs for non-sensitive claims like user IDs and permissions.

JWT vs Session Cookies

JWTs are stateless – the server doesn't need to store session data. This makes them ideal for distributed systems and microservices. However, JWTs cannot be easily revoked before expiration. Session cookies are stateful – the server maintains session data and can revoke sessions immediately, but requires session storage and doesn't scale as easily across multiple servers.

Frequently Asked Questions

Is it safe to decode JWTs?

Yes, JWTs are designed to be decoded. The payload is base64 encoded, not encrypted. Anyone can decode a JWT to read its contents. The security comes from the signature, which prevents tampering. Decoding doesn't reveal the secret key used to sign the token.

Can this decoder verify JWT signatures?

No, this tool only decodes and displays the JWT contents. Signature verification requires the secret key used to sign the token, which should never be shared or exposed. For signature verification, use your server-side code with the proper secret key.

Why do I get "Invalid JWT format" errors?

Valid JWTs must have exactly three parts separated by dots (header.payload.signature). Make sure you've copied the entire token and haven't accidentally removed or added characters. Also ensure you're not including "Bearer " or other prefixes.

What happens when a JWT expires?

When the current time exceeds the expiration time (exp claim), the JWT should be rejected by the server. The client must obtain a new JWT, typically by refreshing the token or logging in again. Our decoder shows the expiration time in the payload so you can check if a token is still valid.