JWT Tool

Decode, verify, and create JSON Web Tokens with advanced features. All processing happens in your browser.

JWT to Decode

Verification

💡 Use a strong secret key (at least 256 bits) in production

💡 Accounts for clock drift when validating exp/nbf/iat claims.

Header

Payload

Missing exp

Quick Code Examples

Node.js (jsonwebtoken)

const jwt = require('jsonwebtoken');

// Sign a token
const token = jwt.sign(
  { sub: '1234567890', name: 'John Doe' },
  'your-256-bit-secret',
  { expiresIn: '1h' }
);

// Verify a token
const decoded = jwt.verify(token, 'your-256-bit-secret');

Python (PyJWT)

import jwt
import datetime

# Encode a token
payload = {
    'sub': '1234567890',
    'name': 'John Doe',
    'exp': datetime.datetime.utcnow() + datetime.timedelta(hours=1)
}
token = jwt.encode(payload, 'secret', algorithm='HS256')

# Decode a token
decoded = jwt.decode(token, 'secret', algorithms=['HS256'])

Security Best Practices

  • • Never expose JWT secret keys in client-side code or version control
  • • Use strong secrets (at least 256 bits) for HMAC algorithms
  • • Always validate JWT expiration and other time-based claims
  • • Consider using asymmetric algorithms (RS256, ES256) for better security
  • • Store sensitive data server-side and reference it via claims like 'sub'