JSON Web Token security guide
Decode JWTs safely and inspect common security risks
JSON Web Tokens are compact credentials used by web and mobile applications. This JWT decoder lets developers inspect the header and payload, understand token claims, and spot configuration mistakes without sending the token to a server.
What to inspect in a JWT
Review the signing algorithm, issuer, audience, subject, issued-at time, and expiration. A decoded payload is not proof that a token is authentic: the server must verify the signature and validate every security-relevant claim before granting access.
- Unexpected algorithm values
- Missing or expired exp claims
- Incorrect issuer or audience
- Sensitive data in the payload
Common implementation mistakes
Never trust the decoded payload on its own, accept an algorithm selected by the token, or use a weak shared secret. Keep access tokens short-lived, rotate signing keys safely, and enforce authorization on the server for every protected action.
Keep credentials private
The decoder runs in your browser, but anyone who has a live access token may be able to use it. Use a redacted or expired sample whenever possible and never paste production credentials into a tool you do not control.