Real Tool: This JWT decoder performs actual Base64 decoding in your browser. No data is sent to any server. Note: This tool decodes tokens but cannot verify signatures without the secret key.
JWT Structure Reference
Standard Claims
| Claim | Name | Description |
|---|---|---|
| iss | Issuer | Who issued the token |
| sub | Subject | Who the token is about (user ID) |
| aud | Audience | Who the token is intended for |
| exp | Expiration | When the token expires (Unix timestamp) |
| nbf | Not Before | Token not valid before this time |
| iat | Issued At | When the token was issued |
| jti | JWT ID | Unique identifier for the token |
Common Algorithms
| Algorithm | Type | Security |
|---|---|---|
| none | None | DANGEROUS - Never use! |
| HS256 | HMAC + SHA-256 | Secure (symmetric) |
| HS384 | HMAC + SHA-384 | Secure (symmetric) |
| HS512 | HMAC + SHA-512 | Secure (symmetric) |
| RS256 | RSA + SHA-256 | Secure (asymmetric) |
| RS384 | RSA + SHA-384 | Secure (asymmetric) |
| RS512 | RSA + SHA-512 | Secure (asymmetric) |
| ES256 | ECDSA + P-256 | Secure (asymmetric) |
Security Warning:
- Never trust a JWT without verifying its signature
- Always validate the
algheader - reject "none" algorithm - Check
expclaim to ensure token hasn't expired - Validate
issandaudclaims match expected values - Never store sensitive data in JWT payload (it's only Base64 encoded, not encrypted)
Related Resources
Test Your Knowledge
FixTheVuln Store
Studying for CompTIA Security+? Get the Study Planner
Fillable PDF study planners with domain trackers, weekly schedules, and progress tracking. Available in Standard, ADHD-Friendly, Dark Mode, and 4-Format Bundle.
CompTIA Security+ Planner60+ certifications available — from $5.99