About JWT (JSON Web Tokens)
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.
JWT Structure
A JWT consists of three parts separated by dots (.):
- Header: Contains the token type (JWT) and signing algorithm (e.g., HS256)
- Payload: Contains the claims (statements about an entity and additional data)
- Signature: Used to verify the sender and ensure the message wasn't changed
Features
- Decode JWT tokens to view header and payload
- Encode custom JWT tokens with header and payload
- Verify JWT signatures with secret key
- Support for HS256 (HMAC SHA-256) algorithm
- Real-time encoding and decoding
- Copy decoded parts or encoded tokens
- Visual signature validation feedback
Use Cases
- Authentication: Verify user identity in web applications
- Authorization: Grant access to protected resources
- Information Exchange: Securely transmit information between parties
- API Security: Secure REST APIs and microservices
- Single Sign-On (SSO): Enable SSO across multiple applications
- Debugging: Inspect JWT tokens during development
How to Use
Decode Mode:
- Paste your JWT token in the input field
- View the decoded header and payload automatically
- Enter the secret key to verify the signature (optional)
- Check if the signature is valid or invalid
Encode Mode:
- Enter or modify the header JSON
- Enter or modify the payload JSON
- Optionally provide a secret key to sign the token
- Copy the generated JWT token
Common JWT Claims
| Claim | Description | Example |
|---|---|---|
| iss | Issuer | "https://example.com" |
| sub | Subject | "1234567890" |
| aud | Audience | "https://api.example.com" |
| exp | Expiration Time | 1735689600 |
| iat | Issued At | 1516239022 |
| nbf | Not Before | 1516239022 |
Supported Algorithms
This tool currently supports HMAC SHA-256 (HS256) for signing and verification. HS256 uses a secret key to sign the token and the same key to verify it.
Security Best Practices
- Always use HTTPS when transmitting JWT tokens
- Keep your secret keys secure and never expose them
- Set appropriate expiration times (exp claim)
- Use strong, random secret keys (at least 256 bits for HS256)
- Validate all claims on the server side
- Don't store sensitive data in the payload (it's only base64 encoded)
- Implement token refresh mechanisms for long-lived sessions
Privacy & Security
All JWT encoding, decoding, and verification happens locally in your browser using the Web Crypto API. Your tokens and secret keys are never sent to any server, ensuring complete privacy and security.