JWT decoder & encoder | Secure, simple, and user-friendly

JWT Decoder

Your data is 100% private -- JWT is fully decoded and encoded directly on your device.

Learn about JWT

All information you concern about JWT and step-by-step guide to verify JWT in diverse framework.

What is JWT?

JWT (JSON Web Token) is a self-contained, stateless token that carries information in a structured and readable format. Whether you’re protecting an API or adopting token-based authentication for your application, JWTs are a powerful tool, because they:

Stateless: JWTs are self-contained and do not require server-side state to validate. JWT can ensure data integrity via signatures.
Cross-service compatibility: JWTs can be easily shared and verified across different services.
Extensible: The payload of a JWT can contain custom claims, allowing for flexible authorization and info sharing.

Learn more

The structure of JWT

A typical JWT is split into three parts, each encoded in Base64URL and separated by periods (.):

Header - Contains metadata, such as the signing algorithm (e.g., HS256 or RS256) and the token’s type (JWT).
Payload - Contains the actual data, like user ID, user profile, expiration time, or scopes.
Signature - A hashed combination of the Header, Payload, and secured using a secret key. Its purpose is to ensure the token's integrity and confirm that it has not been altered.

This structure enables JWTs to provide a compact, secure way of transmitting information between parties.

Common token claims in JWT

The claims are part of the payload and hold the key information. Here are standardized Registered Claims for your refer:

Claims	Full name	Description
iss	Issuer	The entity that issued the JWT, like the authorization server.
sub	Subject	Identifies the JWT's subject, typically representing the authenticated user.
aud	Audience	Specifies which recipients can accept and process the token. This can be an array of values for multiple audiences or a single value for a single recipient.
exp	Expiration Time	Sets an expiration time on the token after which it becomes invalid. This helps prevent replay attacks by limiting how long a token remains valid.
nbf	Not Before	Makes a token valid only after this timestamp. Helpful in situations where clocks are not accessible.
iat	Issued At	When the token was created. This can be used to determine the token's age.
jti	JWT ID	A unique identifier for the token, useful to prevent the same token from being used multiple times (e.g., in replay attacks).

Depending on the specification and the configuration of the authorization server, additional claims may be included in the payload to support specific use cases. You can also add custom claims to JWT to meet unique business requirements.

ID Token \
Used in OpenID Connect, it includes claims like profile information (e.g., name, email, etc.) about the authenticated user. Access Token \
Used in OAuth 2.0, it grants access to specific resources or APIs on behalf of the user or application.

Caution: Do not store private or sensitive information in JWT claims. While JWT claims are encoded (using Base64URL), they are not encrypted. This means anyone with the token can decode it and view the claims, even if they cannot alter it without invalidating the signature. Use encryption or other secure methods to safeguard sensitive data when necessary.

When to use JWT?

JWTs can be particularly beneficial in the following scenarios:

Microservices architecture: For stateless authentication across multiple services.
Single sign-on (SSO) systems: Enabling access to multiple applications with one authentication.
Mobile applications: Efficiently maintaining user sessions across API calls.
High-traffic applications: Reducing database load in high-volume environments.
Cross-origin resource sharing (CORS): Simplifying authentication across multiple domains.
Serverless architectures: Providing stateless authentication where server-side sessions are challenging.

Learn more

How to verify JWT?

The integrity of a JWT must be verified to ensure its header and payload have not been tampered with. Below are step-by-step examples for verifying JWTs in popular programming environments: