JWT Decoder

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact, URL-safe format for transmitting claims between parties. Unlike traditional session-based authentication, JWTs are stateless and self-contained, making them ideal for distributed systems, microservices, and API authentication.

A JWT consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature

• Header: Specifies the token type (JWT) and cryptographic algorithm (alg) used for signing. Common algorithms include HS256 (HMAC-SHA256), RS256 (RSA-SHA256), ES256 (ECDSA-SHA256), and none (unsigned, insecure).
• Payload: Contains claims—statements about an entity (user, application) and metadata. Claims are categorized as registered (standardized by RFC 7519), public (defined in IANA registry), or private (custom application-specific claims).
• Signature: Cryptographic signature created by combining the encoded header, encoded payload, and a secret (HMAC) or private key (RSA/ECDSA). Verifies token authenticity and integrity, preventing tampering.

JWTs are commonly used in OAuth 2.0, OpenID Connect, and REST API authentication. They eliminate the need for server-side session storage, enabling horizontal scaling and cross-domain authentication.

How JWT Decoding and Verification Works

JWTs use Base64URL encoding (RFC 4648 Section 5), which replaces + with -, / with _, and omits padding = characters. This makes tokens URL-safe and suitable for HTTP headers, query parameters, and cookies.

Our decoder performs the following steps:

1. Token Parsing: Splits the token into three parts using the dot (.) separator. Validates that exactly three parts exist.
2. Base64URL Decoding: Converts each part from Base64URL to UTF-8. Handles padding restoration and character encoding conversion.
3. JSON Parsing: Parses the decoded header and payload as JSON objects. Validates JSON syntax and structure.
4. Claim Extraction: Identifies standard claims (iss, sub, aud, exp, iat, nbf, jti) and calculates human-readable timestamps from Unix epoch values.
5. Signature Verification: Uses the Web Crypto API to verify signatures. For HMAC algorithms, recreates the signature using the provided secret. For RSA/ECDSA algorithms, verifies using the public key. Compares the computed signature with the token's signature using constant-time comparison to prevent timing attacks.

Technical Details: Signature verification uses the browser's native Web Crypto API (SubtleCrypto), ensuring cryptographic operations match industry standards. Supported algorithms include HMAC (HS256, HS384, HS512) and RSA (RS256, RS384, RS512). RSA keys must be in PEM format with proper headers (-----BEGIN PUBLIC KEY-----). All processing occurs client-side—no data leaves your browser.

Standard JWT Claims (RFC 7519)

The JWT specification defines seven registered claims. These are optional but recommended for interoperability and security.

Best Practice: Always include exp and iat claims. Use iss and aud in multi-tenant or microservices architectures. Implement jti if you need token revocation capabilities.

When to Use a JWT Decoder

• Authentication Debugging: Verify that tokens contain expected claims (user ID, roles, permissions) before implementing authorization logic. Check for missing or incorrect aud claims causing 401 errors.
• Expiration Troubleshooting: Diagnose "token expired" errors by comparing exp timestamps with server time. Identify clock skew issues or incorrect token lifetime configurations.
• API Integration: Inspect tokens from third-party OAuth providers (Google, Auth0, Okta) to understand claim structure and verify custom claims before implementing user mapping logic.
• Security Audits: Review token structure for vulnerabilities: unsigned tokens (alg: "none"), weak algorithms (HS256 with short secrets), missing expiration claims, or exposed sensitive data in payloads.
• Microservices Debugging: Trace authentication flow across services by verifying iss and aud claims. Ensure tokens are properly validated at each service boundary.
• Signature Verification Testing: Test signature validation logic by verifying tokens with known secrets/keys before deploying authentication code to production.

For comprehensive JWT security practices and OAuth 2.0 implementation guidance, read our detailed guide: Understanding JWT Tokens and OAuth2 — Secure Your Applications with Proven Techniques

Security & Privacy Guarantees

This tool is designed with security-first principles. All cryptographic operations use the browser's native Web Crypto API, ensuring industry-standard security without external dependencies.

• Zero Data Transmission: All processing occurs client-side using JavaScript. No network requests are made—tokens, secrets, and keys never leave your browser.
• No Persistence: Tokens are not stored in localStorage, sessionStorage, cookies, or server logs. Refreshing the page clears all data.
• Cryptographic Verification: Signature verification uses constant-time comparison algorithms to prevent timing attacks. Supports industry-standard algorithms (HMAC-SHA256/384/512, RSA-SHA256/384/512).
• Transparent Implementation: Source code is available for security review. Uses standard Web APIs (SubtleCrypto) with no proprietary cryptographic libraries.

Security Warning: JWTs contain sensitive authentication credentials. If intercepted, tokens can be used to impersonate users until expiration. Never paste production tokens into public forums, screenshots, or untrusted tools. Always verify the tool's privacy policy before use. This tool processes data entirely in your browser—verify by checking network requests in browser DevTools.

JWT Decoding Best Practices

• Verify Algorithm First: Check the alg claim matches your server's expected algorithm. Reject tokens with alg: "none" (unsigned tokens are a security risk). Ensure your server whitelists allowed algorithms.
• Validate Expiration: Always check exp before processing tokens. Account for clock skew (typically 5-10 minutes tolerance). Use nbf if implementing token activation delays.
• Inspect Custom Claims: Review application-specific claims (roles, permissions, tenant IDs) to ensure they match expected values. Use the Claims Table view for easier reading.
• Cross-Reference Server Logs: Compare iat timestamps with server-side token generation logs to identify timing discrepancies or token reuse issues.
• Test Signature Verification: Use the verification feature to test your secret/key before implementing validation in code. Verify both valid and invalid signatures to test error handling.
• Audit Token Structure: Ensure tokens don't contain sensitive data (passwords, credit cards) in the payload. Remember: JWT payloads are Base64-encoded, not encrypted—anyone can decode them.