JSON Web Token (JWT) Decoder
Paste encoded JWT string to instantly view Header, Payload claims, Issued At, and Expiry dates in formatted JSON. 100% Client-side safe.
{}
{}
Complete Guide to JSON Web Tokens (JWT) & RFC 7519 Architecture
A JSON Web Token (JWT) is an open industry standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe JSON object. JWTs are the primary backbone of modern web authentication, Single Sign-On (SSO), OAuth 2.0 authorization, and microservice identity propagation.
The Three Anatomy Segments
- 1. Header (Red): Declares the cryptographic algorithm (e.g., HS256, RS256) and token type (
JWT). - 2. Payload (Purple): Contains the claims—entity data such as user ID, role permissions, and timestamps.
- 3. Signature: Cryptographic hash of the encoded Header and Payload created with a private secret or certificate to ensure tamper-proof transmission.
Crucial: Decoding vs. Verifying
- Base64URL is NOT Encryption: The payload of a JWT is readable by anyone who inspects network traffic. Never store plaintext passwords, credit cards, or API secrets in a JWT payload!
- Backend Signature Validation: Servers must cryptographically verify the signature against the HMAC secret or RSA public key before trusting payload claims.
Standard Registered JWT Claims (RFC 7519)
| Claim Key | Full Name | Data Type | Purpose & Usage |
|---|---|---|---|
| sub | Subject | String | Unique identifier of the authenticated user or entity |
| exp | Expiration Time | Unix Timestamp | Exact second after which the token must be rejected by servers |
| iat | Issued At | Unix Timestamp | Timestamp when the authentication server minted the token |
| iss | Issuer | String / URI | Identity Provider authority (e.g. auth0.com, accounts.google.com) |
| aud | Audience | String / Array | Intended recipient or backend resource server |
Frequently Asked Questions (FAQs)
Can anyone read the payload of my JWT?
Yes. JWT payloads are simply serialized into standard Base64Url encoding, which is an encoding format, not an encryption method. Anyone with access to the token string can decode and read the JSON properties without needing a secret key.
What is the difference between HS256 and RS256?
HS256 (HMAC with SHA-256) uses a single symmetric shared secret key to both sign and verify tokens. RS256 (RSA Signature with SHA-256) is asymmetric: the auth server signs tokens with a private key, and microservice APIs verify the signature using the public key.
Is my token data sent to your servers during decoding?
No. Decoding is processed 100% locally in your browser using client-side JavaScript. No tokens, claims, or user data are ever transmitted or saved on our backend.