How JSON Web Tokens (JWT) Work
A JSON Web Token (JWT, RFC 7519) is a compact, URL-safe means of transferring claims between two parties.
A JWT consists of three parts separated by dots (.):
- Header: Specifies the cryptographic algorithm (e.g.
HS256,RS256) and token type (JWT). - Payload: Contains the claims (e.g. user ID, role, permissions, and expiration timestamp).
- Signature: Cryptographic hash of the Header and Payload, ensuring the token was not tampered with.
Standard JWT Claims Reference
Here are the standard registered claim keys defined in RFC 7519:
exp(Expiration Time): Unix timestamp after which the token is invalid.iat(Issued At): Unix timestamp when the token was generated.sub(Subject): The principal ID (user ID, account UUID).aud(Audience): The recipient identity for whom the token was generated.iss(Issuer): The identity of the authorization server that issued the token.
Why You Should Never Paste Sensitive JWTs into Remote Web Decoders
Many online JWT decoders send tokens across the network to a remote backend server for parsing or analytics logging. If your JWT contains sensitive user emails, tenant IDs, admin roles, or session hashes, pasting it into an untrusted site creates a security exposure. This tool runs 100% client-side in JavaScript: nothing is transmitted over the wire.