JWT decoder

A JWT is three URL-safe base64 segments separated by dots:

header.payload.signature

• Header — JSON describing the algorithm (alg) and token type (typ). Often also kid (key id) for rotation.
• Payload — JSON claims. Registered claims (iss, sub, aud, exp, nbf, iat, jti) plus any private claims your app adds.
• Signature — raw signature bytes, base64url-encoded. Verifies the header + payload haven't been tampered with.

The header and payload are encoded, not encrypted. Treat anything you put in the payload as public.

Signature verification requires the issuer's signing key:

• HS256/384/512 — symmetric. The same secret signs and verifies. Pasting it into a browser tool gives that tool the ability to forge any token from your issuer.
• RS256, PS256, ES256, EdDSA — asymmetric. The verifier needs only the public key, usually exposed via a JWKS endpoint.

For HS-family algorithms, asking users to paste their secret would create a credential harvesting vector. We refuse to do it. For real verification use jose (Node / browser), jsonwebtoken (Node), pyjwt (Python) or your framework's equivalent — and always fetch keys from your trusted JWKS endpoint over HTTPS.

• alg: none — unsigned tokens. Several libraries historically accepted them as valid, leading to trivial bypass. Always reject.
• alg confusion — verifier expects RS256 (public key) but accepts HS256 with the public key used as the HMAC secret. Pin the expected algorithm in your verification call.
• kid injection — the kid header tells the verifier which key to use. Validate it against your JWKS, never use it to look up arbitrary files.