JWT Decoder
JWT Decoder
Decode and inspect JSON Web Tokens (JWT) payload instantly
Securing the Web: What is a JWT?
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA. In modern web development, JWTs are the primary mechanism for authentication and authorization in Single Page Applications (SPAs) and microservices architecture.
The Anatomy of a JWT
A JWT consists of three parts, separated by dots (.), which are encoded in Base64Url:
- Header: Typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.
- Payload: Contains the "claims." Claims are statements about an entity (typically, the user) and additional data. There are three types of claims: registered, public, and private claims.
- Signature: To create the signature part, you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.
Understanding JWT Claims
Claims are the meat of the JWT. Standard registered claims include:
- iss (Issuer): Identifies the principal that issued the JWT.
- sub (Subject): Identifies the principal that is the subject of the JWT (e.g., user ID).
- aud (Audience): Identifies the recipients that the JWT is intended for.
- exp (Expiration Time): Identifies the expiration time on or after which the JWT must not be accepted for processing.
- iat (Issued At): Identifies the time at which the JWT was issued.
Why You Need a JWT Decoder
When developing an application, you often need to check if the claims in your token are correct. Is the expiration time set properly? Does the user ID in the 'sub' claim match your database? Since JWTs are Base64 encoded, they look like gibberish at first glance. A JWT Decoder allows you to instantly see the raw JSON data inside without having to write any code. This is particularly useful for frontend developers who need to check why their application thinks a session has expired or for backend developers verifying the tokens generated by their authentication service.
Security Note
It is crucial to remember that decoding a JWT is not the same as verifying it. Decoding simply shows you the information inside. Anyone who gets hold of your JWT can decode it. This is why you should never put sensitive information like passwords or private keys inside a JWT payload. Verification, on the other hand, requires a secret or a public key to ensure that the token hasn't been tampered with. This tool provides decoding for inspection purposes and does not perform cryptographic verification.