# JWT Decoder

Decode and inspect JSON Web Tokens instantly. Client-side only.

## Token

Load Sample

## About JWT Tokens

JSON Web Tokens (JWT) are a compact, URL-safe way to represent claims between two parties. They consist of three parts: a header, a payload, and a signature.

### Header

Contains the token type and signing algorithm (e.g., HS256, RS256).

### Payload

Contains the claims: user data, expiration, issuer, and custom fields.

### Signature

Verifies the token hasn't been tampered with. Cannot be verified client-side without the secret.

## How to Use This JWT Decoder

1. Paste your JWT token — Copy the full token string (starting with `eyJ...`) into the input field above.
2. View decoded header and payload instantly — The header reveals the signing algorithm and token type, while the payload shows all claims and user data.
3. Check expiration status — If the token contains an `exp` claim, the decoder will show whether the token is still valid or has expired.

## Common JWT Claims

- **iss**: Issuer — identifies who created the token
- **sub**: Subject — identifies the principal (usually a user ID)
- **exp**: Expiration — Unix timestamp after which the token is invalid
- **iat**: Issued At — Unix timestamp when the token was created
- **aud**: Audience — intended recipient of the token
- **nbf**: Not Before — token is not valid before this timestamp
- **jti**: JWT ID — unique identifier to prevent token replay

## JWT Security Best Practices

- Always validate signatures server-side before trusting token contents
- Check expiration (`exp`) before trusting any claims
- Use HTTPS for all token transmission to prevent interception
- Keep signing keys secret and rotate them periodically
- Set reasonable expiration times — shorter-lived tokens reduce risk

## FAQ

### Can this tool verify JWT signatures?

This tool decodes only. Signature verification requires the secret key (for HMAC) or the public key (for RSA/ECDSA) and should always be performed server-side as part of your authentication flow.

### Is it safe to paste my JWT here?

Yes. All decoding happens entirely in your browser using JavaScript. No data is sent to any server — you can verify this by checking the network tab in your browser's developer tools.

### What algorithms does JWT support?

Common algorithms include HS256 (HMAC-SHA256), RS256 (RSA-SHA256), and ES256 (ECDSA-SHA256). The algorithm is specified in the token's header under the `alg` field.