• Paste your JWT token into the input field.
• The decoder will automatically split and decode the token into header, payload, and signature sections.
• View the decoded components in a readable JSON format.
• You can verify the token signature by entering the secret or public key used to sign it.
• All processing happens in your browser - your tokens are never sent to our servers.

JWT (JSON Web Token) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

A JWT consists of three parts, separated by dots (.):

• Header - Contains the token type and signing algorithm.
• Payload - Contains the claims or token data.
• Signature - Ensures the token hasn't been altered.

A typical JWT looks like: xxxxx.yyyyy.zzzzz

A typical JWT might look like this:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

When decoded:

Header:

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload:

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

• Authentication: The most common use of JWTs is for authentication. After a user logs in, a JWT is returned and must be included in subsequent API requests to verify the user's identity.
• Information Exchange: JWTs can securely transmit information between parties, with the signature ensuring the data hasn't been tampered with.
• Authorization: JWTs can contain user permissions and roles, enabling fine-grained access control.

• Never store sensitive data in a JWT payload as it can be easily decoded.
• Always verify signatures before trusting the content of a JWT.
• Set appropriate expiration times for your JWTs to limit the window of potential misuse.
• Consider token revocation strategies for cases where you need to invalidate tokens before they expire.
• Use HTTPS to transmit JWTs to prevent token theft via man-in-the-middle attacks.