Secure JWT Decoder

RFC 7519 Specification & Anatomy of a JSON Web Token

A JSON Web Token (JWT) is an open, industry-standard RFC 7519 method for securely transmitting information between parties as a compact, self-contained JSON object. Widely adopted in modern authentication protocols like OAuth 2.0 and OpenID Connect (OIDC), JWTs verify user identities and claims in single-page applications and distributed microservices.

Every standard JWT consists of three distinct parts separated by period characters (.):

1. Header: A Base64URL-encoded JSON object specifying the token type (typically JWT) and the cryptographic signing algorithm used (such as HS256, RS256, or ES256).
2. Payload (Claims): A Base64URL-encoded JSON object containing user claims and metadata. Standard claims defined by RFC 7519 include iss (issuer), sub (subject/user ID), exp (expiration timestamp), nbf (not before), iat (issued at), and aud (audience), alongside custom application claims like user roles and permissions.
3. Signature: The cryptographic hash computed over the encoded header and payload using a shared secret (for HMAC) or a private key (for RSA/ECDSA). The signature verifies that the token sender is authentic and that the payload was not tampered with in transit.

Important Security Architecture: Our JWT Decoder operates 100% in your local browser using Base64URL decoding. Your production bearer tokens, session IDs, and secret claims are never uploaded to remote servers or logged, protecting you against token leakage.

How to Decode and Verify JWTs in Node.js & Python

Below are standard implementations for inspecting and verifying tokens in backend services:

// Node.js using jsonwebtoken library
import jwt from 'jsonwebtoken';

const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...";
const SECRET_KEY = process.env.JWT_SECRET;

try {
  // Verifies signature AND checks expiration (exp claim)
  const decoded = jwt.verify(token, SECRET_KEY);
  console.log("Authenticated user:", decoded.sub);
} catch (err) {
  console.error("Invalid token:", err.message);
}

# Python 3 using PyJWT
import jwt

token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
SECRET_KEY = "your-256-bit-secret"

try:
    decoded = jwt.decode(token, SECRET_KEY, algorithms=["HS256"])
    print(f"User ID: {decoded.get('sub')}")
except jwt.ExpiredSignatureError:
    print("Token has expired.")
except jwt.InvalidTokenError:
    print("Invalid signature or malformed token.")

Decoding vs Cryptographic Verification

A critical security misconception among novice developers is confusing decoding with verification:

• Decoding (What this tool does): Anyone in possession of a JWT can easily decode the header and payload because they are merely Base64URL encoded, NOT encrypted. A JWT does not hide data from the client.
• Verification (What your backend must do): Only an entity that knows the secret key (for symmetric HS256) or the public key (for asymmetric RS256/ES256) can verify that the signature matches the payload. Never trust unverified claims extracted from a decoded token on the server.

JWT Security Best Practices in Production

When architecting token-based authentication systems, enforce these defensive guidelines: always set short expiration times (5 to 15 minutes) combined with rotating refresh tokens; store access tokens in secure HTTP-only cookies or memory rather than localStorage to mitigate Cross-Site Scripting (XSS) risks; and reject tokens with the insecure "alg": "none" header algorithm.

JOSE Header Anatomy, Cryptographic Signature Verification & Claims Validation

JSON Web Tokens (JWTs), defined in RFC 7519, provide compact, URL-safe representations of claims transferred between two parties. A standard JWT consists of three base64url-encoded parts separated by periods: Header (JOSE), Payload (Claims), and Cryptographic Signature.

Decoding a JWT allows client developers to inspect token validity, audience scope (aud), issuer identity (iss), and expiration epochs (exp). However, developers must remember that client-side decoding does not verify cryptographic authenticity. Backend APIs must verify the signature against the server's public key (RS256/ES256) or HMAC shared secret (HS256) before granting administrative privileges.

Frequently Asked Questions