About JWT (JSON Web Tokens)
JWTs are a compact, URL-safe means of representing claims to be transferred between two parties. They consist of three parts: header, payload, and signature.
JWT Structure
- Header: Contains metadata about the token (algorithm, type)
- Payload: Contains claims (user ID, expiration, permissions, etc.)
- Signature: Verifies the token hasn't been tampered with
Common JWT Claims
- sub (subject): The user ID or identifier
- iat (issued at): Timestamp when token was issued
- exp (expiration): Timestamp when token expires
- aud (audience): Intended recipient of the token
- iss (issuer): Who issued the token
Frequently Asked Questions
Is it safe to decode JWTs?
JWTs are not encrypted - they're encoded (Base64). Anyone can decode them. The signature provides integrity, not confidentiality. Don't put sensitive data in JWTs.
How do I verify a JWT signature?
Signature verification requires the secret key (for HMAC) or public key (for RSA/ECDSA). This tool only decodes the token, it doesn't verify signatures.
What's the difference between encoded and encrypted?
Encoded data (like JWT) can be decoded by anyone. Encrypted data requires a key to decrypt. JWTs are encoded, not encrypted.
Should I store sensitive data in JWTs?
No. JWTs can be decoded by anyone. Only store non-sensitive claims like user ID, expiration time, and permissions.
How long should JWTs be valid?
Depends on security requirements. Access tokens: minutes to hours. Refresh tokens: days to weeks. Always set reasonable expiration times.