JWT Decoder

Structure

A JSON Web Token has three Base64url-encoded segments separated by dots: a header naming the signing algorithm, a payload of claims, and a signature over the first two. The header and payload are encoded, not encrypted. Anyone holding the token can read every claim in it. The signature does not hide the contents; it only proves they have not been altered.

Never put secrets in a payload

Because the payload is readable by anyone who intercepts or is issued the token, it must not carry anything confidential: no passwords, no full personal records, no internal credentials. A surprising number of production tokens contain email addresses, roles and internal identifiers the holder was never meant to see. Decode your own and check.

Registered claims worth knowing

exp is the expiry as a Unix timestamp and must be validated on every request. iat is issued-at and nbf is not-before. iss identifies the issuer and aud the intended audience; both must be checked, otherwise a valid token minted for a different service will be accepted by yours. sub identifies the subject and jti gives the token a unique ID, which is what makes selective revocation possible.

The alg:none attack

The specification permits an alg value of none, meaning unsigned. A verifier that reads the algorithm from the token's own header and trusts it can be handed a token with the signature stripped and alg set to none, and will accept forged claims. The related confusion attack swaps RS256 for HS256 so the verifier uses the public key as an HMAC secret. Both are avoided the same way: pin the expected algorithm server-side and reject anything else. Never let the token tell you how to verify it.

Revocation is the hard part

A signed JWT is valid until it expires and there is no built-in way to revoke one, so a stolen token remains usable for its full lifetime. That argues for short expiry on access tokens, typically minutes, with a longer-lived refresh token that can be revoked because it is checked against server state. Long-lived access tokens are convenient and are the reason JWT compromises tend to be severe.

This decoder does not verify

Decoding shows you what a token says. Verifying proves it is genuine, which requires the signing key. This tool decodes and inspects locally, and flags an expired token, a missing expiry, an alg of none, and an unusually long lifetime. Nothing is sent anywhere, which matters because a JWT is a live credential.