How to Decode, Inspect, and Debug JSON Web Tokens (JWT) Safely
Learn how JSON Web Tokens (JWT) work under the hood. Step-by-step guide to decoding Base64URL string headers and payloads, validating signature algorithms, and preventing critical security vulnerabilities.
Execute this task live in your browser
Step-by-Step Guide
Copy Your Raw JSON Web Token String
Copy the encoded JWT string (header.payload.signature) from your web application HTTP headers (`Authorization: Bearer <token>`), browser storage, or OAuth2 callback URL.
Paste into the Client-Side JWT Decoder
Paste the string into the input box of the Toolioz JWT Decoder. The token is parsed instantly in your browser memory without being sent to external servers.
Inspect Decoded Header Parameters & Payload Claims
Examine the JSON Header for signing algorithms (`alg`: HS256, RS256) and inspect Payload claims including subject (`sub`), issuer (`iss`), expiration (`exp`), and custom user roles.
Validate Expiration Timestamps & Signature Integrity
Check whether the token expiration timestamp is currently valid or expired, and optionally enter your secret key to verify cryptographic signature validity.
Anatomy of a JSON Web Token (RFC 7519 Specification)
A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between client and server as a JSON object. A valid JWT string consists of three distinct parts separated by dots (`.`):
1. Header: Specifies token metadata, including the signing algorithm used (e.g., `{"alg": "HS256", "typ": "JWT"}`).
2. Payload: Contains claims about an entity (typically the user) and additional session data (e.g., `{"sub": "1234567890", "name": "Jane Doe", "admin": true, "exp": 1774483200}`).
3. Signature: A cryptographic hash created by taking the Base64URL-encoded header, Base64URL-encoded payload, and signing them with a secret key or private key.
Why Base64URL Encoding Is NOT Encryption
A common misconception among developer beginners is assuming that JWT tokens encrypt user payload data. They do not.
Base64URL encoding is a reversible representation format that converts binary data into URL-safe ASCII characters. Anyone who intercepts a JWT string can decode its contents in seconds using standard browser APIs (`atob`). Never store sensitive information such as plain text passwords, credit card numbers, or social security details inside unencrypted JWT payloads.
Common JWT Vulnerabilities: Algorithm Confusion & None Attacks
Security flaws in JWT implementations often arise from improper signature verification logic on backend authentication servers:
• The "alg": "none" Exploit: Early JWT parsing libraries allowed tokens to bypass verification if an attacker set the header `"alg": "none"`. Modern JWT verification middleware must explicitly require a valid algorithm whitelist.
• Algorithm Confusion Attack (RS256 vs. HS256): If a backend expects an asymmetric RS256 signature (which verifies using a public key) but accepts an HS256 token signed with the server public key as a symmetric HMAC secret, an attacker can forge valid admin tokens.
Where to Store Tokens: HttpOnly Cookies vs. LocalStorage
Storing JWT session tokens in browser `localStorage` or `sessionStorage` leaves them vulnerable to Cross-Site Scripting (XSS) attacks. If an attacker injects a malicious script, they can read `localStorage.getItem("token")` and exfiltrate credentials.
The recommended production architecture is storing authentication JWTs inside `SameSite=Strict`, `HttpOnly`, `Secure` HTTP cookies, which prevents JavaScript code from accessing token storage.
Frequently Asked Questions
Can I decode a JWT token if I do not know the secret key?
Yes. The Header and Payload sections are only Base64URL encoded and can be decoded by anyone. However, you cannot verify or tamper with the signature without knowing the secret key.
What is the `exp` claim in a JWT payload?
The `exp` (expiration time) claim identifies the Unix epoch timestamp after which the token must not be accepted for authentication processing.
What is the difference between HS256 and RS256?
HS256 is a symmetric algorithm using a single shared secret key for signing and verifying tokens. RS256 is an asymmetric algorithm using a private key to sign tokens and a public key to verify signatures.
Is my secret key transmitted over the internet when using Toolioz JWT Decoder?
No. Toolioz parses and verifies tokens entirely inside client-side browser JavaScript. Your secret key is never sent over any network socket.