About

jwtcodec was created and is maintained by the YouTube channel The Seasoned Programmer, who also makes b64codec.com. Questions or suggestions? Email info@the-seasoned-programmer.com.

Every tool on this site runs in your browser using the built-in Web Crypto API. Tokens, secrets and keys are never sent to a server.

What is a JWT?

A JSON Web Token (RFC 7519) is a compact, URL-safe way to pass a set of claims between two parties. It's most often used as an access token: after you sign in, the server gives you a JWT, and you send it with each request.

GET /api/profile HTTP/1.1
Host: api.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.…

Because the token is signed, the server can trust its claims without looking anything up in a database. It only needs to check the signature and the expiry.

Registered claims

• iss (issuer): who created and signed the token.
• sub (subject): who the token is about, usually a user ID.
• aud (audience): who the token is intended for.
• exp (expiration time): after this time the token must be rejected.
• nbf (not before): the token must not be accepted before this time.
• iat (issued at): when the token was created.
• jti (JWT ID): a unique ID, useful for revocation lists.

Times are NumericDate values: seconds (not milliseconds) since 1 January 1970 UTC.

Signing algorithms

• HS256/384/512 (HMAC): one shared secret both signs and verifies. Simple, but every service that verifies tokens can also create them.
• RS256 / PS256 (RSA), ES256 (ECDSA), EdDSA: a private key signs and a public key verifies. Identity providers publish their public keys as a JWKS, so anyone can verify tokens without being able to forge them.

Security best practices

• The payload is not secret. Anyone can decode it, so never put passwords or personal data you wouldn't show the user in a JWT.
• Pin the algorithm when verifying, and reject none.
• Always check exp, iss and aud, not just the signature.
• Keep tokens short-lived and use refresh tokens for long sessions. A JWT can't be revoked before it expires without extra infrastructure.
• Use strong secrets: at least 256 random bits for HS256.