Encoded Token
Invalid JWT

No data

Signature Verification (OPTIONAL)

Enter the secret used to sign the JWT below:

Secret Key

Verification happens entirely in your browser. No tokens are sent to external servers.

Decoded Header
No data
Decoded Payload
No data
Signature
No data
What is JWT?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties. It is digitally signed, making it verifiable and trustworthy. JWTs can be signed using HMAC algorithms or RSA/ECDSA public/private key pairs.

xxxxx.yyyyy.zzzzz

Header: Algorithm and token type information
Payload: Claims (user info and metadata)
Signature: Signature for token integrity verification
Registered Claims
iss

Issuer - The entity that issued the token

sub

Subject - The subject of the token (usually user ID)

aud

Audience - The recipients the token is intended for

exp

Expiration Time - Unix timestamp when token expires

nbf

Not Before - Token is invalid before this time

iat

Issued At - Unix timestamp when token was issued

jti

JWT ID - Unique identifier for the token

JWT Use Cases
  • Authentication

    Issue JWT after user login to verify identity in subsequent requests

  • Information Exchange

    Verify sender identity and detect content tampering through signatures

  • Single Sign-On (SSO)

    Maintain authentication across multiple services with a single token

  • API Authorization

    Secure API call authentication between microservices

Security Considerations
  • JWT is encoded, not encrypted. Never include sensitive information (passwords, credit cards, etc.) in the payload.
  • Use a strong secret key of at least 256 bits.
  • Set appropriate token expiration (exp) and consider using refresh token patterns.
  • Store tokens in httpOnly cookies instead of localStorage to prevent XSS attacks.
  • Always use HTTPS in production to prevent token exposure over the network.
Supported Algorithms

HS256

HMAC + SHA-256. The most commonly used symmetric key algorithm

HS384

HMAC + SHA-384. Enhanced security with longer hash than HS256

HS512

HMAC + SHA-512. Symmetric key algorithm with the longest hash

This tool only supports HMAC-based symmetric algorithms (HS*). RSA/ECDSA asymmetric algorithms require separate public/private key pairs.