About jwt decoder
A JSON Web Token has three parts separated by dots: header, payload and signature. The first two are Base64URL-encoded JSON, so they can be read without any key.
What you will see
- The header with the signing algorithm and token type.
- The payload with claims such as sub (subject), iat (issued at) and exp (expiry).
- The signature, which this tool does not verify because that needs the secret or public key.
Security
Decoding is not verifying. Never trust a token's contents until the server has verified its signature. Treat tokens like passwords and avoid pasting live production tokens into websites.
A worked example
The first part of a token, eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9, decodes to {"alg":"HS256","typ":"JWT"}. The middle part decodes to claims such as the user ID and expiry. The third part is the signature, which looks random because it is a hash.
Checks worth making
- Is exp in the future, and iat not in the future?
- Does iss name the issuer you expect, and aud name your app?
- Does the alg match what your server accepts? Never accept alg none.
