Security Tool

JWT Decoder

Decode, validate, and inspect JSON Web Tokens (JWT). View header, payload, and signature details instantly.

Security Tool

Instant Decode

No Data Storage

"I was debugging an authentication issue for hours. Then I decoded the JWT with this tool and saw the token had expired. Fixed in 5 minutes. Every developer needs a JWT decoder in their toolkit."

— Priya S., Full Stack Developer

JWT Decoder & Validator

Paste your JWT token below to decode and inspect

Enter JWT Token

What is JWT (JSON Web Token)?

JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. It's digitally signed so it can be verified and trusted.

            ✨ Why JWTs are Popular:
            🔐 Stateless Authentication: No server-side session storage needed
📦 Self-Contained: Contains all user information within the token
🌐 Cross-Platform: Works with any programming language
⏱️ Expiration Control: Tokens expire automatically for security
🔏 Tamper-Proof: Signatures ensure token hasn't been altered

        

JWT Structure: Three Parts

HEADER.PAYLOAD.SIGNATURE

Example:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header

Contains: Token type (JWT) and signing algorithm (HS256, RS256)

Example: {"alg": "HS256", "typ": "JWT"}

Payload

Contains: Claims (user data, permissions, expiration)

Example: {"sub": "123", "name": "John", "exp": 1516239022}

Signature

Purpose: Verifies token hasn't been tampered with

Created by: Signing (header + payload) with secret key

Common JWT Claims (Standard Fields)

Claim	Full Name	Description
`iss`	Issuer	Identifies who issued the token
`sub`	Subject	Identifies the user (often user ID)
`aud`	Audience	Identifies recipients of the token
`exp`	Expiration Time	UNIX timestamp when token expires
`nbf`	Not Before	Token not valid before this time
`iat`	Issued At	Time token was issued
`jti`	JWT ID	Unique identifier for the token

JWT Security Best Practices

Use Short Expiration Times

Set exp to 15-60 minutes for access tokens. Use refresh tokens for longer sessions. Short-lived tokens reduce damage if compromised.

Store Secrets Securely

Never hardcode secrets in client-side code. Use environment variables for HS256. Use RS256 with private/public keys for added security.

Validate All Claims

Always validate iss, aud, exp, and nbf claims. Don't trust unverified claims. Use strict validation in your auth middleware.

Use HTTPS Only

Always transmit JWTs over HTTPS. Never send tokens over unencrypted HTTP. Tokens can be intercepted in transit otherwise.

Don't Store Sensitive Data

JWTs are base64 encoded, not encrypted. Anyone can decode and read the payload. Never store passwords or credit cards in JWT.

Implement Token Blacklisting

For logout functionality, maintain a blacklist of revoked tokens. Check blacklist before accepting any token.

How to Generate JWT in Different Languages

🟨 JavaScript (Node.js)

const jwt = require('jsonwebtoken');
const token = jwt.sign(
  { userId: 123, role: 'admin' },
  'secret_key',
  { expiresIn: '1h' }
);

🐍 Python

import jwt
payload = {'userId': 123, 'role': 'admin'}
token = jwt.encode(payload, 'secret_key', algorithm='HS256')

☕ Java

String token = Jwts.builder()
  .setSubject("123")
  .claim("role", "admin")
  .signWith(SignatureAlgorithm.HS256, "secret_key")
  .compact();

🐘 PHP

use Firebase\JWT\JWT;
$payload = ['userId' => 123, 'role' => 'admin'];
$token = JWT::encode($payload, 'secret_key', 'HS256');

💎 Ruby

payload = { userId: 123, role: 'admin' }
token = JWT.encode payload, 'secret_key', 'HS256'

⚙️ Go

token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims{
  "userId": 123,
  "role": "admin",
})
tokenString, _ := token.SignedString([]byte("secret_key"))

Frequently Asked Questions

Is JWT secure?

Yes, when used correctly. JWTs are signed cryptographically, making them tamper-proof. However, they are base64 encoded, not encrypted. Never store sensitive data like passwords in JWT payload. Always use HTTPS and short expiration times.

How long should a JWT be valid?

For access tokens: 15-60 minutes. For refresh tokens: days or weeks. Short-lived tokens reduce damage if compromised. Use refresh tokens to obtain new access tokens without re-authentication.

What's the difference between HS256 and RS256?

HS256 uses a single secret key (symmetric). RS256 uses public/private key pair (asymmetric). RS256 is more secure for microservices since the public key can be shared without compromising the private signing key.

Can I decode JWT without the secret?

Yes, you can decode the header and payload using base64 decoding (as this tool does). But you can't verify the signature without the secret. The signature verification is what proves the token hasn't been tampered with.

Does this tool store my JWT?

No! All processing happens in your browser. Your JWT never leaves your device. We don't store, log, or transmit tokens anywhere. Complete privacy guaranteed.

Is this JWT decoder free?

Yes! All tools on Tyzo are completely free. No sign-up, no credit card, no hidden fees. Use it for development, debugging, and learning.

Working with JWT tokens regularly?

Bookmark this decoder for quick inspection and debugging of your authentication tokens.

JSON Formatter JSON Validator