JWT Viewer

About JWT Decoder

JSON Web Tokens (JWT) are the industry standard for stateless authentication and authorization. Defined in RFC 7519, JWTs are used in OAuth 2.0 flows, OpenID Connect, API authentication headers (Bearer tokens), and session management across virtually every modern web application and microservice architecture.

JWT Structure Reference

A JWT consists of three Base64URL-encoded parts separated by dots: the Header (algorithm and token type, e.g. {"alg":"HS256","typ":"JWT"}), the Payload (claims about the user/entity), and the Signature (for verifying the token was not tampered with). Standard registered claims include iss (issuer), sub (subject), aud (audience), exp (expiration), iat (issued at), and nbf (not before).

Critical security note: JWT payloads are Base64URL-encoded, not encrypted. Anyone who intercepts the token can decode and read the payload without the secret key. Never store sensitive data like passwords or PII in JWT claims. Always validate the exp claim before trusting a token. For sensitive payloads, use JWE (JSON Web Encryption, RFC 7516) instead. The alg: none attack — where an attacker strips the signature — is a known JWT vulnerability; always verify that your library enforces algorithm validation.

FAQ