JWT and Token Analyzer
Free online JWT and Token Analyzer that runs directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "1234567890",
"name": "Jane Developer",
"role": "admin",
"iat": 1771495089,
"nbf": 1771495119,
"exp": 1771498749,
"iss": "toolsti-demo",
"aud": "toolsti-users"
}
Rate this tool:
Related tools
Other tools you may find usefulJWT Analyzer – decode and parse JSON Web Token
JWT (JSON Web Token) is an RFC 7519 standard for securely transmitting claims between sites. Used in authentication (Bearer token), OAuth 2.0 and OpenID Connect. The tool decodes the token without sending it to the server, displays the header, payload and verifies the signature.
JWT token structure
JWT = header.payload.signature (3 parts separated by dots). Header (base64url): {"alg":"HS256","type":"JWT"}. Payload (base64url): claims – sub, iss, exp, iat, aud + custom. Signature: HMACSHA256(base64(header)+"."+base64(payload), secret) or RSA/ECDSA. Header and payload decoding: base64url decode only – no key required. Verification: requires key.
Standard JWT claims
sub (subject): User ID. iss (issuer): token issuer (e.g. auth.example.com). aud (audience): token recipients. exp (expiration): Unix expiration timestamp (seconds). iat (issued at): issue time. nbf (not before): valid from. jti (JWT ID): unique identifier. Claim exp: always check! Expired token = invalid, despite the correct signature.
JWT Signature Algorithms
HS256 (HMAC-SHA256): symmetric - same key for signing and verification. Simple, but the key must be a shared secret. RS256 (RSA-SHA256): asymmetric – private key signs, public key verifies. Safer for distributed systems. ES256 (ECDSA-SHA256): smaller key than RSA, faster. none: no signature – DANGEROUS, never in production.
JWT Security
Never store secrets in payload (no key required for decoding). Verify exp in every request. Don't use "none" algorithm. Check aud (audience): a token for another service should not work. Short life time: access token 15-60 min. Refresh token: longer, secure in HttpOnly cookie. JWK (JSON Web Key): endpoint for retrieving public keys.
FAQ
How to manually decode JWT?
echo "eyJhbGciOiJIUzI1NiJ9" | base64 -d (Linux, add == padding if needed). Python: import base64, json; json.loads(base64.urlsafe_b64decode(part+"==")). JavaScript: atob(part.replace(/-/g,"+").replace(/_/g,"/")). jwt.io tool: popular, but sends token to Googles server - do not use with production tokens.
What is the difference between JWT and session token?
Session token: random string (UUID), server stores token→data mapping in DB or Redis. JWT: self-contained – data in token, server does not need DB lookup. JWT advantages: scalability (stateless), microservices (each service verifies itself). JWT disadvantages: cannot invalidate before exp (blocklist needed), larger size.
How do I invalidate a JWT before it expires?
Problem: JWT is valid for exp, you can't "log out" the token like a session. Solutions: (1) Short exp (15 min) + refresh token rotation. (2) Redis blacklist token (jti → revoked). (3) Key change (invalidates all tokens at once). (4) Versioned tokens: user.token_version in DB, token contains version, check if match.
How to test JWT in API tools?
Postman: Authorization → Bearer Token → paste JWT. Insomnia: Auth → Bearer. curl: -H "Authorization: Bearer TOKEN". HTTPie: http GET URL "Authorization: Bearer TOKEN". Decode in terminal: echo TOKEN | cut -d. -f2 | base64 -d (payload only). Check exp: date -d @TIMESTAMP (Linux).
Why is JWT criticized?
Complexity: many scenarios where (server-side) sessions are simpler and more secure. Alg confusion: if the server accepts "alg":"none" = critical vulnerability. RS256 key co