JWT Decoder & Validator

A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe JSON object. It is the backbone of modern authentication systems: when you log into a web app or call a protected API, the server typically issues a JWT that the client presents on subsequent requests to prove its identity. AJWT decoder lets you inspect exactly what that token contains without contacting the issuing server.

The Three Parts of a JWT

Every JWT is composed of three base64url-encoded segments joined by dots:

• Header — declares the signing algorithm (alg, such as HS256 or RS256) and the token type (typ: JWT).
• Payload — carries the claims: statements about the user and metadata like sub, iss, exp, and iat.
• Signature — a cryptographic hash of the encoded header, encoded payload, and a secret (or private key). This is what guarantees the token hasn't been tampered with.

Decoding vs. Verifying a JWT

It is critical to understand the difference. Decoding reverses the base64url encoding so you can read the header and payload. Because the payload is only encoded — not encrypted — anyone can decode it. Verifying goes a step further by recomputing the signature with the server's secret or public key to confirm the token is authentic and unmodified. Decoding alone is useful for debugging, but you must verify on the server before trusting any claim.

Standard JWT Claims Explained

Registered claims give tokens predictable structure. The most common are iss (issuer), sub (subject),aud (audience), exp (expiration time, as a Unix timestamp), iat (issued-at time), andnbf (not-before time). Issuers may also embed custom claims such as a user's role or tenant ID.

Security Best Practices

JWTs are safe for authentication only when used correctly. Always verify the signature with the correct secret or public key, enforce theexp claim, validate the iss and aud, and transmit tokens exclusively over HTTPS. Never place passwords, API keys, or other secrets inside the payload — it is readable by anyone who holds the token. Prefer asymmetric algorithms like RS256 or ES256 over symmetric HS256 in distributed systems so verifiers only need a public key.