JWT Decoder & Validator

## Decode and Understand JSON Web Tokens JSON Web Tokens (JWTs) are the open standard (RFC 7519) for securely transmitting information between parties as a JSON object. They are the backbone of modern stateless authentication. The **JWT Decoder** allows you to inspect the contents of a token without needing the secret key. ### Anatomy of a JWT A JWT consists of three parts separated by dots (`.`): 1. **Header**: Defines the algorithm (e.g., HS256) and token type. 2. **Payload**: Contains the "claims" (data). This is what you usually want to read. 3. **Signature**: Verifies that the sender is who they say they are. `xxxxx.yyyyy.zzzzz` ### Common Claims Cheatsheet | Claim | Name | Description | | :--- | :--- | :--- | | **sub** | Subject | Whom the token refers to (e.g., user ID). | | **iss** | Issuer | Who created the token. | | **exp** | Expiration | Timestamp when the token becomes invalid. | | **iat** | Issued At | Timestamp when the token was created. | | **aud** | Audience | Who is this token intended for? | ### Security Best Practices - **No Sensitive Data**: The payload is Base64Url encoded, **NOT encrypted**. Anyone can read it. Never put passwords or credit card info in a JWT. - **Always Use HTTPS**: Tokens are sent in HTTP headers. Without SSL, identifiers can be intercepted. - **Short Expiration**: Keep `exp` short (e.g., 15-60 min) and use Refresh Tokens for long sessions. - **Algorithm Confusion**: Ensure your backend explicitly verifies the algorithm (e.g., HS256) to prevent "None" algo attacks. ### How this Tool Works This decoder runs entirely in your browser using JavaScript. It splits the token, Base64 decodes the header and payload, and formats the JSON. **Your tokens are never sent to our servers.**