Security & Auth
JWT Decoder
Inspect JSON Web Tokens in your browser. Color-coded header, payload, and signature breakdown with real-time expiration checks. Zero network requests — your tokens never leave your browser.
{
"alg": "HS256",
"typ": "JWT"
} {
"sub": "usr_0a1b2c3d4e",
"name": "Alex Vermeer",
"email": "alex@users.example.com",
"role": "engineer",
"iss": "https://auth.owltheengineer.com",
"aud": "https://api.owltheengineer.com",
"iat": 1700000000,
"exp": 1999999999,
"jti": "f83d9e1-781c-4157-b89c-0f8162f37998"
} dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk Signature is verified using the secret key (for HMAC) or public key (for RSA/ECDSA) on the server.
How JSON Web Tokens Work
A JSON Web Token (JWT) is an open standard (RFC 7519) defining a compact and self-contained way for securely transmitting information between parties as a JSON object.
1. Header
Specifies the token type (JWT) and the cryptographic signing algorithm used, such as HS256 (HMAC-SHA256) or RS256 (RSA-SHA256).
2. Payload
Contains the claims (statements about an entity, usually the user) and additional metadata such as iss (issuer), exp (expiration), and sub (subject).
3. Signature
Calculated by encoding the header and payload with Base64URL, concatenating them with a period, and signing using your secret or private key.
Common JWT Pitfalls
- Signed is not encrypted: A standard JWT is readable by anyone who holds it. Never store sensitive passwords, API keys, or raw personal secrets in the payload.
- Algorithm "none" vulnerability: Always enforce strict algorithm checking on your backend server to prevent attackers from bypassing authentication with
"alg": "none". - Missing expiration (exp): Always set a short expiration for access tokens (5–15 minutes) and rotate credentials using secure refresh tokens.