JSON Tool
JWT Decoder
Decode and inspect JSON Web Tokens (JWT). View header, payload, claims, and expiration status.
JWT Token
Loading editor...
About JWT (JSON Web Tokens)
JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. The information can be verified and trusted because it is digitally signed.
JWT Structure
A JWT consists of three parts separated by dots (.):
- Header: Contains the token type and signing algorithm
- Payload: Contains the claims (user data and metadata)
- Signature: Verifies the token hasnt been tampered with
Common Claims
- iss: Issuer - Who issued the token
- sub: Subject - The user ID
- aud: Audience - Who the token is intended for
- exp: Expiration Time - When the token expires
- iat: Issued At - When the token was created
- nbf: Not Before - Token is not valid before this time
Security Considerations
- Never store sensitive data in JWT payloads (they are not encrypted)
- Always validate the signature on the server side
- Use short expiration times for sensitive operations
- Store tokens securely (httpOnly cookies preferred over localStorage)