JWT Decoder
Paste a JSON Web Token to inspect its header and payload claims in real time. Everything runs entirely in your browser - tokens are never sent to any server.
Decoded in your browser. The token never leaves this page.
Decoding runs entirely via client-side JavaScript. No tokens, claims, or headers are ever transmitted to any server.
Decode only, no signature verification. Anyone holding a token can inspect its payload, but verifying authenticity requires validating the cryptographic signature against the issuer's public key or shared HMAC secret.
Encoded JWT
Tue, 01 Jan 2030 00:00:00 GMT
Tue, 14 Nov 2023 22:13:20 GMT
Header (Algorithm & Type)
{
"alg": "HS256",
"typ": "JWT"
}Payload (Claims)
{
"sub": "devops-engineer",
"name": "Alex Jordan",
"role": "SRE",
"exp": 1893456000,
"iat": 1700000000,
"iss": "auth-test.kernelry.local"
}How JSON Web Tokens Work in Distributed Systems
A JSON Web Token (RFC 7519) is a compact, URL-safe mechanism for securely transmitting assertions between distributed parties. Tokens consist of three distinct sections concatenated with periods: a base64url-encoded header describing cryptographic metadata, a base64url-encoded payload carrying application claims, and a cryptographic signature verifying data integrity.
Encoding Is Not Encryption
A frequent security misconception is assuming standard JWTs protect confidential information. Because the header and payload are merely base64url-encoded rather than encrypted (JWE), anyone in possession of the token can read user IDs, roles, and email addresses. Never store passwords, API secrets, or private keys inside unencrypted token payloads.
The Verification Distinction
Decoding a token only reveals what claims were asserted. Genuine authentication requires verifying that the signature matches the payload using either an asymmetric public key (such as RS256 or ES256 via JWKS endpoints) or a shared symmetric secret (HS256). Without verification, forged tokens cannot be detected.
JWTs in DevOps & Architecture Interviews
In system design and DevOps interviews, token architecture frequently centers on the tradeoff between stateless authentication and immediate revocation. Stateless JWTs avoid central database lookups on every API hop, enabling microservices to authenticate requests independently. However, revoking a leaked token before its expiration (exp) requires introducing stateful mechanisms like token blacklists in Redis or maintaining short token lifespans (such as 5 to 15 minutes) paired with rotating refresh tokens.