JWT Debugger

JWT Token

JWT Debugger

Inspect and debug JWT tokens to understand their contents.

JWT Structure

JSON Web Tokens have three parts separated by dots:

1. Header: Algorithm and token type 2. Payload: Claims (data) about the user/session 3. Signature: Verification that the token hasn't been tampered with

Common Claims

iss (issuer): Who created the token
sub (subject): Who the token is about
aud (audience): Intended recipient
exp (expiration): When the token expires
iat (issued at): When the token was created
nbf (not before): When the token becomes valid

Security Best Practices

1. Always verify signatures on the server 2. Use short expiration times 3. Include only necessary claims 4. Use HTTPS for token transmission 5. Never store sensitive data in JWT payloads

Frequently Asked Questions

Are JWTs encrypted?

Standard JWTs are signed but not encrypted. The payload can be read by anyone who has the token. For sensitive data, use JWE (JSON Web Encryption) or don't include the data in the token.

How do I store JWTs?

For web apps, httpOnly cookies are most secure. localStorage is convenient but vulnerable to XSS attacks. Never store JWTs in sessionStorage if security is critical.