JWT Reader
Decode and inspect JWT tokens
About JWT Reader
JWT Reader lets you decode and inspect jwt tokens.
Category: API.
Frequently asked questions
What is a JWT?
▾
A JSON Web Token (JWT) is a compact, URL-safe string for transmitting claims between parties. It's composed of three Base64URL-encoded parts separated by dots: header, payload, and signature.
What are the three parts of a JWT?
▾
Header — the signing algorithm (e.g., HS256). Payload — the claims (user ID, expiration, roles). Signature — a cryptographic hash of the first two parts using a secret key, used to verify authenticity.
Is storing a JWT in localStorage safe?
▾
localStorage is accessible to any JavaScript on the page and is vulnerable to XSS attacks. For sensitive auth tokens prefer httpOnly cookies, which are inaccessible to JavaScript.
Why doesn't this tool verify the signature?
▾
Signature verification requires your secret key. Sending that key to a third-party tool would defeat its purpose. Use this tool to inspect the decoded contents; verify signatures in your own code.