JWT Decoder
Decode JWT tokens showing header, payload and signature
Online JWT Token Decoder - Inspect JSON Web Tokens
What is a JSON Web Token (JWT) and how does JWT authentication work?
A JSON Web Token (JWT, pronounced "jot") is an open standard defined in RFC 7519 that describes a compact, self-contained format for securely transmitting information between parties as a signed JSON object. JWTs are widely used for stateless authentication and authorization in modern web applications, REST APIs, Single Sign-On (SSO) systems, microservice architectures and mobile apps. A JWT is made of three parts separated by dots: the header, the payload and the signature.
What is the structure of a JWT token?
The header carries metadata: the token type (typ: "JWT") and the signing algorithm in use (alg: "HS256", "RS256" and so on). The payload carries the claims, which are statements about the user plus metadata: registered claims such as exp (expiration), iat (issued at), iss (issuer), aud (audience) and sub (subject), alongside custom claims like roles or permissions. The signature is produced by combining the Base64URL-encoded header and payload with a secret key (HMAC) or a key pair (RSA/ECDSA), which guarantees the integrity and authenticity of the token.
JWT security best practices
When you implement JWT authentication these security practices matter: never store sensitive information in the payload, because it can be decoded without the key; always verify the signature on the backend before trusting the contents; use short expiration times of 15 to 60 minutes; add refresh tokens for long sessions instead of extending the access token lifetime; transmit tokens over HTTPS only; store tokens in httpOnly cookies rather than localStorage whenever possible; and validate every claim, including iss and aud. This tool lets you inspect tokens for debugging, but remember that signature validation belongs on the server.
If you work with this tool, you will probably also find these useful JWT Secret Generator, HMAC Generator, Base64 Encoder, URL Encoder.
Frequently asked questions
Can this tool validate my JWT signature?
This tool decodes and displays the header and payload of a JWT, but cryptographic validation of the signature requires the matching secret key (for HS256) or public key (for RS256/ES256). For security reasons signature validation must always happen on the server, never in the client or the browser. Our tool is built for debugging and inspection, not for production security validation.
What is the difference between HS256 and RS256 in JWT?
HS256 (HMAC-SHA256) uses symmetric cryptography: a single secret key shared between the issuer that signs and the receiver that verifies. It is simpler but requires sharing that key securely. RS256 (RSA-SHA256) uses asymmetric cryptography with a key pair: the issuer signs with its private key and anyone can verify with the public key. RS256 is preferred in distributed architectures and whenever several services need to verify tokens without knowing the signing key.
Why does my JWT show as expired when the time has not passed?
The exp claim stores the expiration time as a Unix timestamp: seconds elapsed since 1 January 1970 at 00:00:00 UTC (epoch time). The common causes are time zone differences between your browser and the server that issued the token, unsynchronised clocks (clock skew), or confusing seconds with milliseconds. Check that your system clock is synchronised over NTP and that you are reading the timestamp with the right unit.