JSON Web Token (JWT)Auth
What is a JSON Web Token (JWT)?
An open standard (RFC 7519) securely representing authentication claims between two parties in a compact, URL-safe, digitally signed format.
DEVELOPMENT & DATABASES
Decoder JWT & Signature Validator
Paste, decode, audit, verify and even generate JSON Web Tokens — without them ever leaving your browser.
100% local — this token is never sent to any server. Everything is processed right here, in your browser.
RFC 7519 Architecture: JSON Web Tokens (JWT)
Base64Url structure, standard claims, signature algorithms, and stateless security.
JWT Anatomy (Header, Payload, Signature)
A JWT comprises three dot-separated Base64Url parts: Header (algorithm metadata), Payload (user claims), and Signature (cryptographic tamper-proof proof).
Symmetric (HS256) vs Asymmetric (RS256/ES256)
HMAC relies on a shared symmetric secret. Microservices favor asymmetric RS256/ES256 where an Auth Server signs with a private key and consumers verify with public keys.
Registered Claims (exp, iat, nbf, iss, aud)
RFC 7519 establishes UNIX epoch timestamps for `exp` (expiration), `iat` (issued at), and `nbf` (not before), alongside `iss` (issuer) and `aud` (audience).
Short-Lived Access Tokens + Refresh Tokens
Access Tokens should have short lifespans (5-15 mins). Long-term session continuity is handled via opaque Refresh Tokens stored in secure `HttpOnly` cookies.
JWT Verification, Signature & Expiry Troubleshooting
Step-by-step fixes for expired tokens, signature mismatches, and algorithm exploits.
Issue 1
TokenExpiredError / Clock Skew Discrepancy
⚡ Quick Fix:Refresh the token or add `clockTolerance: 30` (seconds) in `jwt.verify()` to accommodate small server clock drifts.
🔧 Technical Fix:Sync server clocks via NTP and verify `exp` timestamps use UNIX seconds instead of milliseconds.
Issue 2
Invalid Signature: Secret Mismatch or PEM Format Error
⚡ Quick Fix:Test the signature with your secret in this tool's validator to verify byte-for-byte matching.
🔧 Technical Fix:When loading RSA keys from `.env`, replace escaped `\n` literals with actual newline characters.
Issue 3
Algorithm Confusion Exploit & 'alg: none' Bypass
⚡ Quick Fix:Always pass explicit algorithm whitelists to the verifier: `{ algorithms: ['RS256'] }`.
🔧 Technical Fix:Never let untrusted header `alg` fields dictate verification routines; reject any token missing rigorous cryptographic pinning.
Issue 4
Insecure Storage in localStorage & XSS Token Theft
⚡ Quick Fix:Store authentication tokens in `HttpOnly; Secure; SameSite=Strict` cookies to block JavaScript access.
🔧 Technical Fix:Adopt in-memory Access Tokens in client state combined with an HttpOnly Refresh cookie for robust defense.
Did You Know? JWT Standard Trivia
Official 'jot' pronunciation, the 4KB header limit, and the stateless revocation paradox.
🗣️
Official Pronunciation: JWT is Pronounced 'Jot'
Section 1 of RFC 7519 explicitly specifies: 'The suggested pronunciation of JWT is the same as the English word *jot*'.
📦
The 4KB HTTP Header & Cookie Overflow
Servers like Nginx enforce 4KB-8KB request header limits. Overloading JWT payloads triggers HTTP `431 Request Header Fields Too Large` errors.
🔄
The Revocation Paradox: Stateless Tokens Can't Be Killed
Because JWT verification is stateless without database roundtrips, valid signatures remain valid until `exp`. Early revocation requires stateful blacklists like Redis.
📜
JOSE: The Complete Cryptographic Family
JWT belongs to the IETF JOSE suite alongside JWS (signatures), JWE (encryption), JWK (key representations), and JWA (algorithms).
JSON Web Tokens (JWT) & Authentication Glossary
Learn the fundamental concepts, protocols, and technical terminology of this tool.
Claims (Afirmaciones)Payload
What are Claims in a JWT payload?
Key-value statements inside the token payload payload expressing identity attributes, roles, and administrative metadata (e.g., `sub`, `exp`, `iss`).
Firma Criptográfica (Signature)Criptografía
Why is a JWT cryptographic signature necessary?
A cryptographic hash calculated over header and payload strings using a shared secret or private key, preventing data tampering in transit.
Expiración (Claim 'exp')Seguridad
What is the 'exp' claim timestamp?
A Unix epoch timestamp defining the exact second after which the authentication token must be rejected by backend API resource servers.