CoderTools

JWT Encoder/Decoder

Decode, verify, and generate JWT tokens securely

Decoded JWT

Header 


                        


                        
                        

                            

                                

                                    Payload                                

                                
                            

                            

                        


                        
                        

                            

                                

                                    Signature                                

                                
                            

                            

                        

                    

                

            


            
            
        

    

    
    

        

            

                Comprehensive Guide to JSON Web Tokens (JWT)            

            
            

                

                    

                        What is JWT (JSON Web Token)?                    

                    

                        JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA. Because of its small size using Base64Url encoding, it can be sent via URL, POST parameter, or inside an HTTP header.                    

                


                

                    

                        The Structure of a JWT                    

                    

                        A JWT technically consists of three parts separated by dots (.), which are:                    

                    

                        xxxxx.yyyyy.zzzzz
                    

                    
    
                        
  • 
                            
                                Header                            : 
                            
                                The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.                            
                        
    • 
                        
  • 
                            
                                Payload                            : 
                            
                                The payload contains the claims. Claims are statements about an entity (typically the user) and additional data. There are three types of claims: registered, public, and private claims.                            
                        
    • 
                        
  • 
                            
                                Signature                            : 
                            
                                To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that. The signature is used to verify the message wasn't changed along the way.                            
                        
    • 
                    

                


                

                    

                        Supported Algorithms                    

                    

                        This tool supports decoding and verification for all standard algorithms and generation for symmetric ones:                    

                    
    
                        
  • HS256: HS256 (HMAC SHA-256): Symmetric. Requires a shared secret key. Fast and common for microservices.
    • 
                        
  • HS384: HS384 (HMAC SHA-384): Symmetric. Uses a 384-bit hash for higher collision resistance.
    • 
                        
  • HS512: HS512 (HMAC SHA-512): Symmetric. Uses a 512-bit hash. Most secure for symmetric signing.
    • 
                        
  • RS256: RS256 (RSA SHA-256): Asymmetric. Uses a Private Key to sign and a Public Key to verify. Ideal for public APIs.
    • 
                        
  • RS384: RS384 (RSA SHA-384): Asymmetric. Stronger hashing than RS256.
    • 
                        
  • RS512: RS512 (RSA SHA-512): Asymmetric. Highest security for RSA signatures.
    • 
                    

                


                

                    

                        Understanding JWT Claims                    

                    

                        Claims are pieces of information asserted about a subject. Standard registered claims include:                    

                    
    
                        
  • iss (Issuer): iss (Issuer): Identifies the principal that issued the JWT.
    • 
                        
  • sub (Subject): sub (Subject): Identifies the principal that is the subject of the JWT.
    • 
                        
  • aud (Audience): aud (Audience): Identifies the recipients that the JWT is intended for.
    • 
                        
  • exp (Expiration Time): exp (Expiration Time): Identifies the expiration time on or after which the JWT must not be accepted.
    • 
                        
  • nbf (Not Before): nbf (Not Before): Identifies the time before which the JWT must not be accepted.
    • 
                        
  • iat (Issued At): iat (Issued At): Identifies the time at which the JWT was issued.
    • 
                        
  • jti (JWT ID): jti (JWT ID): Provides a unique identifier for the JWT.
    • 
                    

                


                

                    

                        When Should You Use JWT?                    

                    
    
                        
  • Authorization: This is the most common scenario. Once the user is logged in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources that are permitted with that token.
    • 
                        
  • Information Exchange: JWTs are a good way of securely transmitting information between parties. Because JWTs can be signed, you can be sure the senders are who they say they are.
    • 
                        
  • Stateless Sessions: Unlike server-side sessions, JWTs contain all necessary user data, reducing database hits for session lookups.
    • 
                        
  • Cross-Domain SSO: Because JWTs are stateless and compact, they are easily transmitted across different domains for Single Sign-On implementations.
    • 
                        
  • API Security: Securing RESTful APIs where the server does not maintain session state.
    • 
                    

                


                

                    

                        
                            Crucial Security Best Practices:
                        
                        
                            1. Do not put sensitive data (like passwords) in the payload; it is readable by anyone (Base64 decoded). 2. Always check the signature. 3. Use 'exp' (Expiration) claims to limit token lifetime. 4. Use HTTPS to prevent token interception. 5. Store tokens securely (HttpOnly cookies are recommended over LocalStorage to prevent XSS attacks).                        
                    

                


                

                    

                        References                    

                    
                

                
                
                

    

        Frequency Asked Questions (FAQ)    

    

                    

                
                    
                        Is JWT encryption or encoding?                    
                    
                
                

                    Standard JWTs are encoded and signed, NOT encrypted. The data in the payload is Base64Url encoded, meaning anyone can decode and read it. The signature ensures the data hasn't been tampered with, but it doesn't hide the data. For hiding data, you need JWE (JSON Web Encryption).                

            

                    

                
                    
                        Where should I store JWTs on the client?                    
                    
                
                

                    For web applications, storing JWTs in `HttpOnly` cookies is generally considered more secure than `localStorage` because cookies are immune to Cross-Site Scripting (XSS) attacks. However, cookies are vulnerable to CSRF, which must be mitigated separately.                

            

                    

                
                    
                        What happens if a JWT is stolen?                    
                    
                
                

                    If a JWT is stolen, the thief can impersonate the user until the token expires. This is why it's critical to use short expiration times (`exp`) and implement token revocation strategies (like blacklisting jti) or use refresh tokens with rotation.                

            

                    

                
                    
                        Does this tool send my keys to a server?                    
                    
                
                

                    No. This tool runs entirely on the client side. Your private keys, secret keys, and token data never leave your browser. All cryptographic operations are performed locally using JavaScript libraries.                

            

                    

                
                    
                        Can I manually modify the payload?                    
                    
                
                

                    You can modify the payload part locally, but if you do, the signature will become invalid based on the original key. The server will reject the token unless you re-sign it with the correct secret/private key.                

            

                    

                
                    
                        What is the difference between HS256 and RS256?                    
                    
                
                

                    HS256 is a symmetric algorithm (uses one shared secret for both signing and verifying). RS256 is an asymmetric algorithm (uses a Private Key to sign and a Public Key to verify). RS256 is better for distributed systems where many services need to verify tokens but shouldn't be able to generate them.                

            

            



            


            
            



    

        
        Related Tools
    

    

                
            

                
            

            

                

                    Base64 Encoder/Decoder                

                

                    Quickly encode and decode Base64 strings, supporting both text and file conversion                

            

            
        
                
            

                
            

            

                

                    HMAC Generator                

                

                    Generate HMAC authentication codes with MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, SHA3, and RIPEMD-160 algorithms                

            

            
        
                
            

                
            

            

                

                    Date Calculator                

                

                    Calculate days between dates, add/subtract days, calculate age, and count business days                

            

            
        
                
            

                
            

            

                

                    JSON Formatter                

                

                    Format and validate JSON data for improved readability and debugging                

            

            
        
                
            

                
            

            

                

                    SHA Hash Generator                

                

                    Online SHA hash generator supporting SHA-1, SHA-256, SHA-384, SHA-512 algorithms                

            

            
        
                
            

                
            

            

                

                    RSA Encryption/Decryption                

                

                    Use RSA asymmetric encryption for public key encryption, private key decryption, digital signing and verification                

            

            
        
            



        

    

    


    
    


    
    

        
        

        
        
    

    
    
    

        
        

            
Quick Menu

        

        
        
        

            

                
                
                
            

        

        
        
        

            

                
                

                    
                    
No recent tools