Skip to content

KEHEM IT

JWT Decoder & Inspector

Decode JWT header, payload, signature, timestamps, and expiration status instantly in your browser.

Decode and inspect JWT

This tool decodes tokens only. It does not verify signatures because verification requires the signing secret or public key.

Length

0

Status

Empty

Expires

-

Countdown

-

Paste a JWT to begin.

Issued At (iat)

-

Expiration (exp)

-

Not Before (nbf)

-

Header

{}

Payload

{}

Signature

-

What is JWT?

JWT stands for JSON Web Token. It is a compact token format used to transmit claims between systems. JWTs are common in API authentication because they can carry identity, issuer, audience, role, and time-based claims in a URL-safe string.

JWT Structure

A standard JWT has three Base64URL-encoded segments separated by dots: header, payload, and signature.

header.payload.signature

Header

The header usually contains the token type and algorithm, such as typ and alg.

Payload

The payload contains claims. Common claims include subject, issuer, audience, issued-at time, expiration time, and permissions.

Signature

The signature lets a server verify that the token was issued by a trusted party and was not modified. Verification requires the signing secret or public key, so a visual decoder should not claim a token is trusted.

How JWT Authentication Works

After a successful login, a server can issue a JWT. The client sends the token with future requests, often in an Authorization header. The server verifies the signature and checks claims such as expiration, issuer, and audience before granting access.

JWT vs Session Authentication

Session authentication stores state on the server and gives the browser a session identifier. JWT authentication can be stateless because claims are inside the token. JWTs are useful for APIs and distributed systems, but they require careful expiration, storage, and revocation strategy.

JWT Security Best Practices

  • Use short expiration times for access tokens.
  • Verify signature, issuer, audience, expiration, and not-before claims on the server.
  • Use strong algorithms and reject unexpected algorithms.
  • Never store secrets or private data in a normal signed JWT payload.
  • Use HTTPS for all token transport.

Common JWT Mistakes and How to Store JWT Safely

Common mistakes include trusting decoded payloads without verification, accepting expired tokens, storing sensitive data in claims, using long-lived tokens, and keeping JWTs in places exposed to cross-site scripting. HttpOnly, Secure, SameSite cookies are often safer for browser apps, while native apps may use secure platform storage.

JWT Examples

JWT in JavaScript

const payload = JSON.parse(atob(token.split(".")[1]));

JWT in Node.js

jwt.verify(token, publicKey, options);

JWT in Python

jwt.decode(token, key, algorithms=["RS256"])

JWT in Django

from rest_framework_simplejwt.tokens import RefreshToken

JWT in Laravel

$token = auth()->attempt($credentials);

JWT in ASP.NET

new JwtSecurityTokenHandler().ValidateToken(...)

JWT in Spring Boot

Jwts.parserBuilder().setSigningKey(key).build().parseClaimsJws(token);

Common Errors

  • Token does not have three dot-separated parts.
  • Header or payload is not valid Base64URL.
  • Decoded header or payload is not valid JSON.
  • Token is expired or missing required claims.
  • Server expects a different issuer, audience, or algorithm.

Frequently Asked Questions

What is a JWT?

A JWT is a compact JSON Web Token used to share claims between systems.

Does this decoder verify signatures?

No. Verification requires the signing secret or public key.

Is JWT data encrypted?

Usually no. Standard JWT payloads are encoded, not encrypted.

Can anyone decode a JWT?

Yes. Anyone with the token can decode its header and payload.

What is exp?

exp is the expiration claim as a Unix timestamp in seconds.

What is iat?

iat means issued at.

What is nbf?

nbf means not before.

Can expired JWTs be decoded?

Yes, but they should not be accepted for authentication.

Should JWTs contain passwords?

No. Never store passwords or secrets in JWT claims.

Where should JWTs be stored?

Use secure storage appropriate to the app. HttpOnly cookies are often safer in browsers.

What is Base64URL?

It is a URL-safe Base64 encoding used by JWT.

What is a malformed JWT?

A malformed JWT has invalid structure, invalid encoding, or invalid JSON.

Can JWTs be revoked?

Yes, but revocation usually requires server-side tracking or short token lifetimes.

What does alg none mean?

It means no signing algorithm. Servers should reject it unless explicitly designed for that case.

Does this tool store tokens?

No. Decoding happens in the browser and the tool does not store tokens.

Conclusion

JWTs are powerful for modern authentication and API authorization, but they must be verified and stored carefully. A decoder helps inspect claims and timestamps, while real trust must always come from server-side signature verification and strict claim validation.