JWT Debugger & Token Inspector

What is a JSON Web Token (JWT) and How Does It Work?

A JSON Web Token (JWT), defined in RFC 7519, is an open industry standard for securely transmitting information between two parties as a compact, self-contained JSON object. Because JWTs are digitally signed using either a symmetric secret key (such as the HMAC SHA-256 algorithm) or an asymmetric public/private key pair (such as RSA or ECDSA), the authenticity and integrity of the contained data can be cryptographically verified.

JWTs are most commonly utilized in modern web architecture for stateless user authentication and authorization. When a user logs in to a web application or REST API, the authentication server signs and issues a JWT containing the user's identity claims (like user ID, email, and permission roles). The client stores this token (typically in an HTTP-only cookie or memory) and sends it within the Authorization: Bearer <token> HTTP request header on subsequent requests.

Anatomy of a JSON Web Token: The Three Segments

A serialized JWT consists of three separate strings separated by periods (.):
<Header>.<Payload>.<Signature>

Standard Registered JWT Claims (RFC 7519 Reference)

While a JWT payload can store custom key-value pairs (such as user permissions or email addresses), the IETF specification reserves a set of standardized claims:

Critical Security Best Practices for JWT Implementations

• Always Enforce the Expected Algorithm on the Backend: Never blindly trust the "alg" header provided by the incoming client token. Attackers have historically exploited weak implementations by modifying the algorithm header to "none" or converting asymmetric RS256 public keys to symmetric HS256 secrets.
• Keep Access Token Lifetimes Short: Access tokens should have a short lifespan (typically 5 to 15 minutes). Couple access tokens with a secure, server-managed Refresh Token Rotation pattern to limit the window of vulnerability if a token is intercepted.
• Store Tokens in Secure HTTP-Only Cookies: Storing authentication JWTs in browser localStorage or sessionStorage leaves them vulnerable to Cross-Site Scripting (XSS) attacks. Storing tokens in SameSite=Strict; Secure; HttpOnly cookies prevents client JavaScript from accessing raw tokens.
• Do Not Store Sensitive Secrets in the Payload: Remember that JWT payloads are merely Base64URL-encoded, not encrypted. Passwords, API secrets, credit card numbers, or personally identifiable information (PII) should never be placed in unencrypted JWT claims.

How to Verify JWTs in Backend Code (Code Snippets)

import jwt from 'jsonwebtoken';

try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET, {
    algorithms: ['HS256'],
    issuer: 'auth.example.com'
  });
  console.log('Valid token payload:', decoded);
} catch (err) {
  console.error('Invalid token:', err.message);
}

import jwt
import os

try:
    payload = jwt.decode(
        token, 
        os.environ['JWT_SECRET'], 
        algorithms=['HS256'],
        issuer='auth.example.com'
    )
    print("Token valid:", payload)
except jwt.ExpiredSignatureError:
    print("Token has expired")
except jwt.InvalidTokenError:
    print("Invalid token signature")

Frequently Asked Questions (FAQ)