JWT Decoder
JWT is decoded locally in your browser — the token is never sent to any server.
Header — algorithm and token type (base64url)
Payload — claims (user data, expiry) (base64url)
Signature — HMAC or RSA/ECDSA signature over header + payload (verify server-side only)
Share with friends
How to use
- 1 Paste your JWT into the input box. The format is three URL-safe Base64 segments separated by dots: header.payload.signature.
- 2 The decoder splits and pretty-prints each segment as JSON.
- 3 Standard claims are highlighted: exp (expiration), iat (issued at), sub (subject), iss (issuer).
- 4 If the token is expired, the decoder warns you with the exact expiration time and how long ago it lapsed.
- 5 This is a decoder, not a verifier — it does not check the signature. To verify, you need the secret (HMAC) or public key (RSA / ECDSA).
About JWT Decoder
FAQ
Q Is it safe to paste a JWT into an online decoder?
A JWT contains user identity and permissions in the payload — assume anyone who decodes it can see that data. This calculator runs entirely in your browser and never uploads, but if your token is sensitive, only paste it into trusted local tools. After debugging, rotate any token that was visible in shared screens or clipboards.
Q What does the alg=none attack mean?
Some buggy JWT libraries accept tokens with <code>"alg": "none"</code> — meaning no signature is required. Attackers craft tokens with arbitrary payloads and the alg field set to none. Properly implemented servers must explicitly allowlist permitted algorithms (HS256, RS256, ES256) and reject everything else.
Q How long should JWT access tokens last?
OWASP and most security guidelines recommend short-lived access tokens (15 minutes to 1 hour) paired with longer-lived refresh tokens (days to weeks). Short access tokens limit blast radius if a token is leaked; refresh tokens can be revoked server-side. Avoid tokens that never expire.
Q What's the difference between HS256 and RS256?
HS256 uses HMAC with SHA-256 and a single shared secret — both signer and verifier must possess the secret. RS256 uses RSA with SHA-256 — the signer holds a private key and verifiers use a public key. RS256 is preferred when many services need to verify tokens (microservices, third parties) without sharing secrets.
Q Where should I store JWTs in a browser?
Tradeoffs: <code>localStorage</code> is convenient but vulnerable to XSS — any script on the page can read it. <code>httpOnly</code> cookies are immune to XSS but require CSRF protection. OWASP and the IETF OAuth WG generally recommend httpOnly cookies for browser apps with proper SameSite settings; SPAs sometimes use sessionStorage with careful Content Security Policy.
Q How do I verify a JWT signature?
Use a JWT library: jsonwebtoken (Node.js), PyJWT (Python), java-jwt (Java), or jose (multi-language). Pass the token, the verification key (HMAC secret or public PEM), and an explicit algorithm allowlist. Never call <code>decode</code> without verifying — that's the most common JWT bug.
Q Can I revoke a JWT before it expires?
Not directly — JWTs are stateless by design. Common workarounds: maintain a server-side token blacklist of recently revoked jti values, keep tokens short-lived (15 min) so revocation requires only waiting briefly, or use opaque session tokens stored server-side instead. Logout that requires immediate revocation is incompatible with pure JWT stateless design.
Q What is jti and do I need it?
jti = JWT ID. It's a unique identifier for the token, useful for replay-attack prevention and revocation lists. Add jti when (a) you need to support revocation, (b) you're issuing one-time tokens, or (c) you want to log every token issued. Skip it for short-lived stateless API tokens that don't need replay protection.
Official resources
IETF RFC 7519 — JSON Web Token
Authoritative IETF specification of the JWT format and standard claims.
IETF RFC 7515 — JSON Web Signature
IETF specification of the signature mechanism used by JWT.
OWASP — JSON Web Token Cheat Sheet
OWASP secure-coding cheat sheet for JWT implementation pitfalls and best practices.
jwt.io — JWT Introduction and Debugger
Auth0's widely used JWT debugger and learning resource.