Decodificador JWT
Decodificar e inspeccionar JSON Web Tokens
Continuar con
Mant?n el flujo de trabajo en movimiento con la siguiente acci?n relacionada.
Privacy & Trust
Encabezado
Decodificar e inspeccionar JSON Web Tokens
Carga Útil
Pegue su token JWT aquí...
Firma
Válido / Expirado
Copiar
Pegue su token JWT aquí...
Siguientes pasos sugeridos
Herramientas Relacionadas
Generador de Hash
Genera hashes SHA-1, SHA-256, SHA-384, SHA-512
Generador de contrasenas
Genera contrasenas aleatorias fuertes y seguras
Generador HMAC
Generar firmas HMAC usando SHA-256, SHA-384 o SHA-512
Generador de Tokens / Secretos
Generar tokens aleatorios, claves API y secretos en varios formatos
Generador de Hash Bcrypt
Hashear contraseñas con Bcrypt y verificar hashes
Codificador / Decodificador Base64
Codifica texto a Base64 o decodifica Base64 a texto rapidamente.
Cómo Usar
Pega o Escribe
Ingresa tu texto, código o datos en el área de entrada.
Elige las Opciones
Selecciona la transformación o formato que deseas aplicar.
Copia el Resultado
Copia la salida a tu portapapeles con un solo clic.
Por Qué Usar Esta Herramienta
100% Gratis
Sin costos ocultos, sin niveles premium — todas las funciones son gratuitas.
Sin Instalación
Se ejecuta completamente en tu navegador. No necesitas descargar ni instalar nada.
Privado y Seguro
Tus datos nunca salen de tu dispositivo. Nada se sube a ningún servidor.
Funciona en Móvil
Totalmente responsivo — úsalo en tu teléfono, tableta o escritorio.
Understanding JSON Web Tokens (JWT) Structure and Security
Key Takeaways
- JWTs consist of three Base64url-encoded parts: header, payload, and signature — the payload is readable by anyone, not encrypted.
- Never store sensitive data in JWT payloads — they can be decoded without the secret key. JWTs provide integrity, not confidentiality.
- All JWT decoding happens in your browser — your tokens are never sent to any external server.
JSON Web Tokens (JWT) are the de facto standard for stateless authentication in modern web applications. They carry claims about a user between services without requiring server-side session storage. Understanding JWT structure is essential for debugging authentication flows, verifying token contents, and identifying security issues.
JWTs are used by over 80% of modern web APIs for authentication and authorization.
Industry Adoption
Key Concepts
Three-Part Structure
A JWT has three Base64url-encoded sections separated by dots: the header (algorithm and type), the payload (claims like user ID, expiration), and the signature (cryptographic proof of integrity).
Registered Claims
Standard claims include iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at), and jti (JWT ID). These provide interoperable token metadata.
Signature Algorithms
HS256 uses a shared secret (symmetric), while RS256 uses RSA key pairs (asymmetric). RS256 is preferred for distributed systems where the verifier should not have the signing key.
Security Considerations
Common JWT vulnerabilities include: accepting 'none' algorithm, using weak secrets, not validating expiration, and confusing HS256/RS256 algorithms. Always validate all claims on the server.
Pro Tips
Always check the 'exp' claim — expired tokens should be rejected. Set short expiration times (15–60 minutes) for access tokens.
Use the 'aud' claim to ensure tokens are only accepted by intended services — this prevents token misuse across services.
Store JWTs in httpOnly cookies rather than localStorage to protect against XSS attacks.
Implement token refresh flows with longer-lived refresh tokens stored securely, rather than issuing long-lived access tokens.
All JWT decoding is performed entirely in your browser. Your tokens, which may contain user identity information and authentication claims, are never transmitted to any server. Note: this tool decodes tokens but does not verify signatures.