Online JWT Token Decoder
Decode JWT tokens online. View header, payload JSON, and signature instantly. 100% client-side — your security tokens are never uploaded or tracked.
Understanding JSON Web Token (JWT) Structure & Security
JSON Web Tokens (RFC 7519) are compact, URL-safe security credentials used for authentication and federated identity across modern API applications.
Standard Registered Claims Reference
JWT payloads contain claims (statements about an entity such as a user) and additional data. The RFC 7519 specification defines standard reserved claims:
| Claim | Name | Type | Description |
|---|---|---|---|
| exp | Expiration Time | Timestamp (Unix) | Identifies the expiration time after which the JWT MUST NOT be accepted for processing. |
| iat | Issued At | Timestamp (Unix) | Identifies the time at which the JWT was created and issued. |
| nbf | Not Before | Timestamp (Unix) | Identifies the time before which the JWT MUST NOT be accepted for processing. |
| sub | Subject | String / ID | Identifies the principal (usually user ID or account GUID) that is the subject of the JWT. |
| iss | Issuer | String / URL | Identifies the principal or OAuth authorization server that issued the token. |
| aud | Audience | String / Array | Identifies the intended recipients or API gateways that should accept the token. |
⚠️ Critical Security Best Practices
- Never Store Secrets in JWT Payload: Base64URL encoding is easily decoded by anyone. Never place plain-text passwords, DB connection strings, or private API keys inside claims.
- Disallow
"alg": "none": Vulnerable JWT verification libraries may accept unsigned tokens if the algorithm header is set tonone. Always enforce algorithm whitelisting server-side. - Rotate Verification Keys: Use asymmetric signing keys (RS256 / ES256) and fetch public keys via JWKS endpoints (
/.well-known/jwks.json) with key rotation.
Frequently Asked Questions (FAQ)
Why does my JWT show an 'invalid signature' warning?
A JWT signature warning occurs because signature verification requires the original secret key or public key. Without the key, the decoder can display header and payload contents but cannot verify if the token was tampered with or issued by a trusted server.
What does alg: none mean and why is it flagged?
The 'alg: none' header specifies that the JWT has no digital signature algorithm applied. This leaves the payload unprotected and vulnerable to spoofing. Modern security standards flag 'alg: none' as an insecure configuration.
Why does my token say it's expired?
JWT payloads include an 'exp' (expiration time) claim containing a Unix timestamp. If the current Unix timestamp is greater than the 'exp' value, the token has expired and will be rejected by authenticating servers.
What is the difference between JWT header, payload, and signature?
A JSON Web Token consists of three dot-separated Base64URL parts: the Header (specifying algorithm and token type), the Payload (containing claims like user ID and expiration), and the Signature (verifying message integrity).