How to decode a JWT
- Paste the token. A leading
Beareris removed for you. - Read the header (the signing algorithm) and the payload (the claims), both formatted as JSON.
- Check the expiry: times are shown as dates, with whether the token has expired.
Registered claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created the token |
sub | Subject | Who the token is about, usually a user ID |
aud | Audience | Who the token is meant for |
exp | Expiration | When it stops being valid (seconds since 1970) |
nbf | Not before | When it starts being valid |
iat | Issued at | When it was created |
jti | JWT ID | A unique ID, used to prevent replay |
Anatomy of a JWT
A JWT is three Base64URL-encoded parts joined by dots: a header saying how it's signed, apayload of claims, and a signature. The server signs the first two parts with a secret or private key; changing a single character of the payload makes the signature fail. That protects the contents from tampering, but not from being read.
Common uses
- Debugging a failed login. When an API answers 401 Unauthorized, paste the token to check whether it has expired or was issued for a different audience.
- Checking what a token contains. See which user ID, roles or scopes your identity provider put in a token before writing code that relies on them.
- A token from the Authorization header. Copy a token straight from your browser's developer tools, Bearer prefix and all, and read it without writing a script.