JWT Debugger

What is a JSON Web Token (JWT)?

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

Structure of a JWT

In its compact form, JSON Web Tokens consist of three parts separated by dots (.), which are:

• Header: Typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.
• Payload: Contains the claims. Claims are statements about an entity (typically, the user) and additional data. There are registered, public, and private claims.
• Signature: To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.

Therefore, a JWT typically looks like the following: xxxxx.yyyyy.zzzzz

Client-Side Security

This JWT Debugger runs entirely in your browser. When you paste a token, it is decoded using client-side JavaScript. Your tokens are never sent to any server. This ensures that sensitive information contained within your JWTs remains secure and private. The tool works completely offline once the page has loaded.

Common Standard Claims

• iss (Issuer): Identifies principal that issued the JWT.
• sub (Subject): Identifies the subject of the JWT.
• aud (Audience): Identifies the recipients that the JWT is intended for.
• exp (Expiration Time): Identifies the expiration time on or after which the JWT MUST NOT be accepted for processing.
• nbf (Not Before): Identifies the time before which the JWT MUST NOT be accepted for processing.
• iat (Issued At): Identifies the time at which the JWT was issued.
• jti (JWT ID): Provides a unique identifier for the JWT.