JWT Decoder

The Anatomy of a JSON Web Token (RFC 7519)

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. Compact JWT strings follow a strict 3-part layout:

• Header: Contains the token metadata, typically the signing algorithm (alg, e.g. HS256 or RS256) and the token type (typ: "JWT").
• Payload: Contains the claims—statements about an entity (typically, the user) and additional metadata such as expiration and issuer.
• Signature: Cryptographic hash calculated by signing the Base64URL encoded header and payload using the specified algorithm and a secret or private key.

Standard JWT Claims Reference (RFC 7519)

The IETF specification reserves seven standard claims for interoperable authentication and authorization:

How to Decode & Verify JWTs in Code

Production applications must verify signatures and expiration timestamps on the server side:

import jwt from "jsonwebtoken";

// Verifying signature and expiration together
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET!, {
    algorithms: ["HS256"],
    issuer: "https://auth.example.com",
  });
  console.log("Authenticated User ID:", decoded.sub);
} catch (err) {
  console.error("Invalid or expired token:", err.message);
}

import jwt

try:
    payload = jwt.decode(
        token,
        key="your-256-bit-secret",
        algorithms=["HS256"],
        options={"require": ["exp", "iss"]}
    )
    print("User ID:", payload["sub"])
except jwt.ExpiredSignatureError:
    print("Token has expired.")
except jwt.InvalidTokenError:
    print("Invalid token signature or format.")

package main

import (
    "fmt"
    "github.com/golang-jwt/jwt/v5"
)

func validateToken(tokenString string, secretKey []byte) (*jwt.MapClaims, error) {
    token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
        if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
            return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
        }
        return secretKey, nil
    })

    if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
        return &claims, nil
    }
    return nil, err
}

JWT Security Checklist for Developers

• Never Put Secrets in the Payload: Passwords, API secret keys, and personal identifying data (PII) should never reside in unencrypted JWT claims.
• Enforce Short Expiration Lifetimes: Access tokens should typically expire within 10–15 minutes. Pair with secure HTTP-only refresh tokens for session renewal.
• Explicitly Check the Algorithm Header: Whitelist expected algorithms (e.g. algorithms: ["RS256"]) to prevent alg: "none" bypass exploits.
• Account for Clock Skew: Allow a small tolerance (e.g. 30–60 seconds) when comparing timestamps across distributed servers to prevent premature expiration errors.

Related Tools & Tutorials