JSON Web Token Decoder — RFC 7519 JWT Parser Online
Decode · Inspect · Verify · Generate JSON Web Tokens — expiry countdown, security warnings, HS256 verify — 100% browser-side
JSON Web Tokens (JWT) are defined by RFC 7519 as a compact, URL-safe means of representing claims between two parties. This parser fully implements the RFC 7519 specification — decoding all registered claim names (iss, sub, aud, exp, nbf, iat, jti) with human-readable descriptions, displaying Unix timestamps in both UTC and IST, and flagging security issues that violate JWT best practices.
What is a JWT Decoder?
A JWT Decoder reads a JSON Web Token and displays its three parts in human-readable format. Every JWT contains a Header (algorithm & type), a Payload (claims — user data, expiry, issuer), and a Signature. This tool decodes all three instantly, shows expiry status with a live countdown timer, highlights standard claims with labels, detects security issues like alg:none, and supports HS256/HS384/HS512 signature verification using the browser Web Crypto API.
JWT Structure — How It Works
A JWT looks like xxxxx.yyyyy.zzzzz — three Base64URL-encoded strings joined by dots. The header and payload are readable by anyone; the signature is what proves authenticity. Only the party holding the secret or public key can verify the signature. This means JWTs should never contain sensitive data like passwords.
Frequently Asked Questions
What are the RFC 7519 registered claim names?
RFC 7519 defines 7 registered claims: iss (Issuer), sub (Subject), aud (Audience), exp (Expiration Time), nbf (Not Before), iat (Issued At), jti (JWT ID). All are optional but recommended. exp is the most important for security — always set a short expiry.
What is the iss claim used for?
iss (Issuer) identifies who created and signed the JWT — typically your auth server's URL like "https://auth.example.com". Servers should validate iss to ensure the token came from a trusted issuer, not an attacker's server.
What is the jti claim and when should I use it?
jti (JWT ID) is a unique identifier for the token, like a UUID. It's used to prevent replay attacks — the server keeps a blacklist of used jti values and rejects tokens whose jti has already been used. Essential for single-use tokens (password reset, email verification).
What is the nbf claim?
nbf (Not Before) is a Unix timestamp before which the token must not be accepted. Useful when you issue tokens for future use — for example, a token that activates in 1 hour. Servers must reject tokens where the current time is before nbf.
Can JWT payload contain any custom claims?
Yes — beyond the 7 registered claims, you can add any custom claims: user roles, permissions, tenant ID, subscription tier, etc. Keep the payload small — JWTs are included in every API request. Avoid storing large data (like full user objects) — store only what's needed for authorization decisions.