JWT Decoder
Decode and inspect JSON Web Tokens to verify their contents and structure
JWT Token
Decoded Token
Paste a JWT above to decode it
About JWT
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.
Structure
A JWT consists of three parts separated by dots (.):
- Header - Contains the type of token and the signing algorithm
- Payload - Contains the claims (statements about an entity)
- Signature - Used to verify that the sender of the JWT is who it says it is
Common Use Cases
- Authentication - Once a user is logged in, each subsequent request will include the JWT
- Information Exchange - JWTs can be used to securely transmit information between parties
- Authorization - JWTs can contain claims about permissions and roles
Security Considerations
- JWTs are not encrypted by default - sensitive data should not be included unless the JWT is encrypted
- Always validate the signature before trusting the content of a JWT
- Set appropriate expiration times for your tokens
- Never use the 'none' algorithm in production