Development Tools
Decode and inspect JSON Web Tokens (JWTs) with header/payload decoding, pretty-printed JSON output, and expiration timestamp analysis.
A JSON Web Token (JWT) is a compact, URL-safe token format used for transmitting claims between parties. JWTs consist of three Base64url-encoded parts separated by dots: the header (algorithm and token type), the payload (claims and data), and the signature (integrity verification). Unlike session cookies, JWTs are self-contained, carrying all necessary information within the token itself, which makes them popular for stateless authentication in APIs and single-page applications.
For security professionals, JWTs are both a useful tool and a common attack surface. The header and payload are Base64url-encoded, not encrypted, meaning anyone with the token can read its contents. The signature prevents tampering but does not provide confidentiality. Understanding this structure is essential for identifying vulnerabilities like algorithm confusion, weak signing keys, and insecure claim handling.
This decoder parses JWTs locally in your browser, showing the header, payload, and signature in readable JSON format. It identifies the signing algorithm, checks expiration status, and highlights security-relevant claims so you can quickly assess token validity and identify potential issues.
The most critical JWT vulnerability is algorithm confusion. When a server accepts the algorithm specified in the token header without validation, an attacker can change the algorithm from RS256 (asymmetric) to HS256 (symmetric) and sign the token with the public key, which is often publicly available. This allows token forgery. Always validate that the algorithm matches what the server expects.
Weak signing keys are another common vulnerability. If a JWT is signed with a short or predictable secret, attackers can brute-force it offline. A 256-bit random secret is recommended for HS256. For production systems, use asymmetric algorithms (RS256 or ES256) with properly managed key pairs, as the private key never needs to be shared with resource servers.
Other vulnerabilities include accepting expired tokens, not validating the issuer and audience claims, storing sensitive data in the payload (which is readable by anyone), and failing to implement token revocation for logout and compromised token scenarios.
JWT claims are predefined fields in the payload that provide standardized information. The most common are iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). Understanding these claims helps you verify token validity, check authorization scope, and identify misconfigurations.
The exp claim is critical for security. Tokens without expiration remain valid indefinitely, which is dangerous if they are compromised. Best practice is to set short expiration times (15-60 minutes) for access tokens and use refresh tokens for renewal. This decoder highlights expired tokens and flags missing or unusual claim values.
Custom claims can carry any data, but storing sensitive information like passwords, credit card numbers, or private keys in a JWT payload is a serious vulnerability because the payload is Base64url-encoded, not encrypted. Anyone who intercepts the token can decode and read the payload. Use JWTs for authentication claims, not for data confidentiality.