Loading...
Loading...
Loading comments...
Decode and verify JSON Web Tokens (JWT) to inspect headers, payloads, and signatures.
Decode JWT tokens to inspect claims, expiration times, and verify token structure for security analysis.
Extract user information, roles, permissions, and custom claims from JWT payload data.
Check token expiration, issued time, and validity to ensure tokens are still active and properly formatted.
JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims to be transferred between two parties. They consist of three parts separated by dots: header, payload, and signature.
A typical JWT used for user authentication after login:
This token contains user identification information and an expiration timestamp.
A JWT with role-based permissions for API access:
This token includes role-based access control information with specific permissions.
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and information exchange in web development.
JWTs are digitally signed using a secret key (with HMAC algorithm) or a public/private key pair (using RSA or ECDSA), ensuring that the information contained within cannot be altered after the token is issued without detection.
A JWT consists of three parts separated by dots (.):
Header
Contains the token type ("JWT") and the signing algorithm being used (e.g., HMAC SHA256 or RSA).
Payload
Contains the claims or assertions about an entity (typically the user) and additional metadata. Common claims include subject (sub), issued at time (iat), expiration time (exp), and issuer (iss).
Signature
Created by signing the encoded header, encoded payload, and a secret key using the algorithm specified in the header. The signature verifies that the message wasn't changed and, in the case of tokens signed with a private key, it also verifies the sender of the JWT.
Authentication: After a user logs in, each subsequent request will include the JWT, allowing the user to access routes, services, and resources permitted with that token.
Information Exchange: JWTs can securely transmit information between parties, as the signature ensures the sender is who they claim to be and the information hasn't been tampered with.
Authorization: Once a user is logged in, an application can allow or deny access to specific features based on the user's role or permissions included in the JWT payload.
Federated Identity: JWTs are used in single sign-on (SSO) scenarios where a service provider can verify a user's identity based on a token issued by an identity provider.
Set appropriate expiration times: Short-lived tokens reduce the window of opportunity for attackers if a token is compromised.
Use HTTPS: Always transmit JWTs over HTTPS to prevent token interception.
Don't store sensitive data: Avoid storing sensitive information in the payload as it can be decoded easily.
Use strong signing keys: Ensure your signing keys are sufficiently complex and kept secure.
Implement token revocation: Have a strategy for invalidating tokens before their expiration time if needed.