JWT Decoder, Encoder & Verifier

What is a JSON Web Token (JWT)?

A JSON Web Token (JWT, pronounced “jot”) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe JSON object. JWTs are widely used for authentication (OAuth 2.0, OpenID Connect), authorization, and information exchange in modern web applications and APIs.

A JWT consists of three Base64URL-encoded parts separated by dots: a header (algorithm and token type), a payload (claims — statements about the user and metadata), and a signature(cryptographic proof that the token hasn't been tampered with).

How Does JWT Authentication Work?

1. The user sends credentials (username/password) to the authentication server.
2. The server validates the credentials and creates a JWT signed with a secret key (HMAC) or private key (RSA/ECDSA).
3. The server returns the JWT to the client (usually in a response body or HttpOnly cookie).
4. The client includes the JWT in the Authorization: Bearer {token} header on subsequent API requests.
5. The API server verifies the JWT signature and extracts user identity and permissions from the payload — without hitting a database on every request.

This stateless approach is what makes JWTs popular in microservices and distributed architectures — any service with the verification key can validate the token independently.

Why Use This JWT Debugger?

• Privacy first: All decoding, encoding, and verification happens in your browser using the Web Crypto API. No tokens are ever sent to our server.
• Instant decode: Paste any JWT to see the header, payload, and signature instantly. Claims like exp, iat, and sub are highlighted.
• Signature verification: Verify HMAC signatures (HS256, HS384, HS512) by entering the secret key.
• Token generation: Create and sign new JWTs with custom headers and payloads for testing.
• Expiration awareness: Instantly see if a token is expired and how much time remains.

JWT Security Best Practices

• Never put secrets in the payload — JWTs are signed, not encrypted. Anyone can decode the payload.
• Use short expiration times — Pair short-lived access tokens (5-15 min) with refresh tokens.
• Store tokens in HttpOnly cookies — Protects against XSS attacks.
• Always validate the signature server-side — Never trust a token without verification.
• Use RS256 for distributed systems — Allows public key verification without sharing secrets.
• Include aud and iss claims — Prevents tokens from being replayed across services.