JWT Decoder & Inspector — Free Online Tool

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and information exchange in web APIs. The token is digitally signed, so you can verify its integrity — but by default the payload is only Base64-encoded, not encrypted.

A JWT consists of three parts separated by dots: Header (algorithm and token type), Payload (claims/data), and Signature (used to verify the token hasn't been tampered with).

JWT Standard Claims

• iss (Issuer) — Who created and signed the token
• sub (Subject) — Who the token is about (usually user ID)
• aud (Audience) — Who the token is intended for
• exp (Expiration Time) — When the token expires (Unix timestamp)
• iat (Issued At) — When the token was issued
• nbf (Not Before) — The token isn't valid before this time
• jti (JWT ID) — Unique identifier for the token

JWT Security Tips

• Never store sensitive data in JWT payloads — the payload is only Base64-encoded, not encrypted. Anyone can decode it.
• Always verify the signature server-side — a decoded JWT doesn't mean it's valid. Always check the signature against your secret key.
• Keep expiry times short — use refresh tokens for long sessions. Short-lived access tokens (15-60 min) limit exposure.
• Avoid the "none" algorithm — some vulnerable implementations accept unsigned tokens. Always enforce a specific algorithm.
• Use HTTPS only — transmit JWTs over encrypted connections to prevent interception.