About This Tool
JSON Web Tokens (JWT) are the standard for secure data transmission in modern web apps. But they're encoded strings, making them impossible to read without decoding. Our free JWT Decoder instantly parses the token to reveal the <strong>Header</strong> (algorithm info) and <strong>Payload</strong> (user data/claims). It helps you debug authentication issues, verify token contents, and check expiration times — and your token isn't sent to any server.
What is a JWT?
A JSON Web Token is a compact, URL-safe means of representing claims to be transferred between two parties. It consists of three parts separated by dots (.):
- Header: Algorithm and token type.
- Payload: The data (claims) like user ID, roles, and expiration.
- Signature: Verifies the token hasn't been tampered with. You can't read this part without the secret key.
Common JWT Claims
- sub (Subject): Whom the token refers to (usually User ID).
- iss (Issuer): Who created the token.
- exp (Expiration): Timestamp when the token expires.
- iat (Issued At): Timestamp when the token was created.
- aud (Audience): Intended recipient of the token, often the API or service domain.
- nbf (Not Before): Token is invalid before this timestamp, useful for delayed activation.
- jti (JWT ID): Unique identifier for the token, used to prevent replay attacks.
Custom claims are added by the issuing application. Common examples include user roles, email addresses, organization IDs, and feature flags. These custom claims ride alongside the standard registered claims and can contain any JSON-serializable data the application needs.
JWT Security Best Practices
JWTs are powerful but require careful handling to maintain security:
- Always validate the signature: Decoding a JWT reveals its contents, but only signature verification confirms it hasn't been tampered with. Don't trust a JWT payload without first verifying the signature server-side.
- Check expiration times: Always verify the
expclaim before accepting a token. Expired tokens should be rejected immediately, even if the signature is valid. - Use short-lived tokens: Access tokens should expire in minutes, not hours or days. Pair them with refresh tokens for a better security posture.
- Store tokens securely: Avoid storing JWTs in localStorage where they are vulnerable to cross-site scripting (XSS). HTTP-only cookies are generally safer for web applications.
- Don't put sensitive data in the payload: JWTs are encoded, not encrypted. Anyone can decode the payload without the secret key. Don't include passwords, credit card numbers, or other secrets in JWT claims.