How to Decode JWT Tokens

What Is a JWT?

The Three Parts of a JWT

• Header — Contains the token type ("JWT") and the signing algorithm (e.g., HS256, RS256). Example: {"alg": "RS256", "typ": "JWT"}
• Payload — Contains the claims: user data, permissions, expiration time, etc. Standard claims include "sub" (subject/user ID), "exp" (expiration), "iat" (issued at), "iss" (issuer).
• Signature — Created by signing header + payload with a secret key (HMAC) or private key (RSA/ECDSA). This prevents tampering — changing any byte in the header or payload invalidates the signature.

Common JWT Claims Explained

• "sub" (Subject): Identifies the user — typically a user ID or email.
• "exp" (Expiration): Unix timestamp after which the token is invalid. Always set this.
• "iat" (Issued At): When the token was created.
• "iss" (Issuer): Who created the token (e.g., your auth server's domain).
• "aud" (Audience): Who the token is intended for (e.g., your API's identifier).
• "nbf" (Not Before): Token is not valid before this time.
• Custom claims: You can add any data — roles, permissions, tenant ID, etc. Keep tokens small though.

Signing Algorithms: HS256 vs RS256

Security Best Practices

• Never store sensitive data in the payload. JWTs are encoded, not encrypted — anyone can decode them.
• Always validate the signature server-side. Never trust a JWT just because it's present.
• Set short expiration times (15-60 minutes for access tokens). Use refresh tokens for longer sessions.
• Always check the "alg" header server-side. The "none" algorithm attack is a classic exploit where attackers remove the signature entirely.
• Validate the "iss" and "aud" claims to prevent token confusion attacks across services.
• Store tokens securely in the browser — HttpOnly cookies are safer than localStorage for web apps.
• Use a token revocation strategy (blocklist or short expiry + refresh) since JWTs can't be invalidated once issued.

When to Use (and Not Use) JWTs

• Good for: Stateless API authentication, single sign-on (SSO), passing claims between microservices, short-lived authorization tokens.
• Not ideal for: Session management (session cookies are simpler and revocable), storing large amounts of data (tokens get big and slow), anything requiring instant revocation.
• If you need to revoke tokens instantly (e.g., user logs out), you need a server-side blocklist, which partially negates the stateless benefit of JWTs.

Using Our JWT Decoder Tool