Is it safe to paste sensitive or production JWTs into this tool?

Yes. This tool is built entirely with client-side JavaScript. All decoding, JSON formatting, and claims inspection execute directly within your browser memory. Your tokens, claims, and secret signatures are never sent to our servers or stored in any logs.

What is the difference between symmetric (HS256) and asymmetric (RS256) JWTs?

HS256 (HMAC with SHA-256) is a symmetric algorithm where the same shared secret key is used to both sign and verify the token. RS256 (RSA with SHA-256) is an asymmetric algorithm where the authorization server signs the token using a private key, and API gateways or client microservices verify the token using a publicly available public key (often published via JWKS).

What are standard JWT registered claims (iss, sub, aud, exp)?

The JWT specification defines optional registered claims: 'iss' (issuer), 'sub' (subject, typically user ID), 'aud' (audience, the intended recipient API), 'exp' (expiration Unix timestamp), 'nbf' (not before timestamp), 'iat' (issued at timestamp), and 'jti' (unique JWT identifier for replay defense).

Can this decoder decrypt encrypted JWTs (JWE)?

Standard JWTs (JWS) are signed, not encrypted—their payload is merely base64url-encoded and can be read by anyone. If a token is encrypted using JWE (JSON Web Encryption), it typically contains five dot-separated parts (header, encrypted key, IV, ciphertext, auth tag) and cannot be decrypted without the corresponding decryption key.

Where should JWT tokens be stored in web applications?

For web browsers, storing access tokens in HttpOnly, Secure, SameSite=Strict cookies provides strong defense against Cross-Site Scripting (XSS) attacks because JavaScript cannot read the cookie. Storing sensitive tokens in localStorage or sessionStorage leaves them vulnerable to extraction if any third-party script is compromised.

Utility #21Client-Side JavaScript

JWT Decoder & Token Inspector

Decode JSON Web Tokens instantly in your browser. Inspect header algorithms, explore payload claims, check expiration status, and format JSON structures with zero network transmission.

Loading JWT Decoder engine...

JWT Architecture & Specification Guide

Anatomy of a JSON Web Token (RFC 7519)

JSON Web Tokens enable stateless authentication across distributed APIs and microservices. Understanding how headers, payloads, and signatures interact ensures secure session management and prevents common cryptographic pitfalls.

1. JOSE Header

The header describes the cryptographic metadata: the signing algorithm (such as HS256 or RS256), the token type (JWT), and optional key identifiers (kid) for key rotation.

2. JWT Claims Payload

The payload contains statements about the user and authorization scope. It carries registered claims (iss, sub, exp), public claims, and custom application metadata.

3. JWS Signature

The signature is calculated by hashing the encoded header and payload using the designated algorithm and secret key. It guarantees that the claims have not been tampered with or modified during transit.

Critical Security Rule: Preventing the "none" Algorithm Vulnerability

RFC 7515 defines an unsecured token algorithm named none. In vulnerable legacy implementations, attackers could craft an unsigned token, set alg: none, and strip the signature entirely. Poorly configured backends accepted the forged payload as authenticated. Modern authentication gateways must explicitly reject any incoming tokens specifying alg: none.

Symmetric Keys (HS256)Best for monolithic architectures where a single backend server both creates and validates session tokens. Keep secret keys at least 256 bits long.

Asymmetric Keys (RS256 / ES256)Recommended for microservices and OAuth2/OIDC. Multiple edge APIs can verify tokens with public keys without sharing the private signing key.

Need to format JSON payloads or convert base64 strings?

Explore our complementary developer utilities for instant encoding, decoding, and JSON validation.

Base64 Converter JSON Formatter Hash Generator

Frequently Asked Questions

A JSON Web Token (RFC 7519) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is digitally signed using JSON Web Signature (JWS) or encrypted using JSON Web Encryption (JWE). A standard JWS token consists of three base64url-encoded parts separated by periods: Header, Payload, and Signature.