What Is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and data exchange between parties. It consists of three Base64-encoded parts separated by dots: header.payload.signature. JWTs are the backbone of modern API authentication, OAuth flows, and single sign-on systems.
Anatomy of a JWT
- Header: Contains the token type (
"typ": "JWT") and signing algorithm ("alg": "HS256"or"RS256") - Payload: Contains claims — data like user ID, email, roles, expiration time (
exp), and issued-at time (iat) - Signature: Cryptographic hash that verifies the token hasn't been tampered with
Paste any JWT into our JWT Decoder to instantly see the decoded header and payload, plus expiration status.
Common JWT Debugging Scenarios
"Token expired" errors
Check the exp claim in the payload. It's a Unix timestamp — use our Timestamp Converter to see the human-readable date. If your tokens expire too quickly, adjust your token lifetime on the issuer side.
"Invalid signature" errors
This usually means the token was signed with a different secret or key than what the verifier expects. Common causes: environment mismatch (dev vs prod keys), key rotation, or token was modified after signing.
"Algorithm mismatch" errors
The header's alg field must match what the server expects. A common attack vector is changing RS256 to HS256 — always validate the algorithm on the server side.
JWT Security Best Practices
- Never store sensitive data in the payload — it's Base64-encoded, not encrypted
- Always validate the signature server-side before trusting any claims
- Set short expiration times — 15 minutes for access tokens, use refresh tokens for longer sessions
- Use HTTPS only — JWTs in transit can be intercepted on unencrypted connections
- Validate the
issandaudclaims — ensure the token was issued by your auth server for your application
Generate Test JWTs
Building an API and need test tokens? Use our JWT Generator to create tokens with custom claims and expiration times. Perfect for development and testing — everything runs locally in your browser.
Related Security Tools
- Base64 Decoder — Decode any Base64 string
- Hash Generator — Generate MD5, SHA-256, and SHA-512 hashes
- Token Generator — Create secure random tokens
- JSON Formatter — Pretty-print JSON payloads