JWT Decoder & Token Inspector
Decode, inspect, and audit JSON Web Tokens (JWT) in real time with syntax-colorized Header, Payload, and Signature visualization. Converts Unix claims timestamps (exp, iat, nbf) into human dates, audits critical vulnerabilities like the "none" algorithm exploit, and ensures 100% client-side privacy with zero data transmission.
Cryptographic Structure of JSON Web Tokens
Governed by RFC 7519, a JSON Web Token is a compact, URL-safe means of representing claims between two parties. The string consists of three distinct parts separated by dots, each serving a cryptographic role.
JOSE Header Metadata
Defines the cryptographic algorithm used to sign the token (e.g. HS256, RS256, ES256) and the token media type.
Payload Claims Set
Encapsulates entity identity attributes, role grants, and mandatory temporal validity constraints to mitigate token replay.
Tamper-Proof Signature
Computed by hashing the header and payload with the issuer private or secret key, ensuring that payloads cannot be altered in transit.
Reserved Standard Claims Glossary
Standard registered claims defined in the RFC 7519 specification for authorization and authentication tokens:
| Claim | Formal Name | Security Purpose | Standard Format | Example |
|---|---|---|---|---|
| iss | Issuer | Identifies the authorization server issuing the token | String / URI | https://auth.toptoollab.com |
| sub | Subject | Unique identifier of the authenticated user or service | String / UUID | usr_94a7e28b1f |
| aud | Audience | Target recipient or API resource intended for this token | String / Array | https://api.toptoollab.com |
| exp | Expiration Time | Timestamp after which the token must not be accepted | Unix Epoch (seconds) | 1735689600 |
| nbf | Not Before | Timestamp before which the token is not yet valid | Unix Epoch (seconds) | 1704067200 |
| iat | Issued At | Timestamp recording when the token was created | Unix Epoch (seconds) | 1704067200 |