Back to CTF Tools

JWT Decoder

Decode and analyze JSON Web Tokens

New

JWT Token Decoder

Paste your JWT token to decode its header, payload, and signature

About JWT

JSON Web Token

JWTs are a compact, URL-safe means of representing claims between two parties.

Structure

JWT consists of three parts:

  • • Header (algorithm & type)
  • • Payload (claims)
  • • Signature (verification)

Security Note

JWT payload is only base64 encoded, not encrypted. Never put sensitive data in JWT claims.

Standard Claims

iss

Issuer - identifies who issued the JWT

sub

Subject - identifies the subject of the JWT

aud

Audience - identifies recipients

exp

Expiration Time - when token expires

iat

Issued At - when token was issued

CTF Tips

Algorithm Confusion

Check if alg=none is accepted or if RS256 can be changed to HS256

Weak Secrets

Try brute forcing the HMAC secret with common passwords

Claims Manipulation

Modify user roles, permissions, or expiration times