JWT (JSON Web Token) is a compact token format for securely transmitting information between parties. It consists of three Base64URL-encoded parts — Header, Payload, Signature — separated by dots.

No. A standard JWT (JWS) is signed, not encrypted. The Payload is only Base64-encoded, so anyone can read it. Never put sensitive data like passwords or personal IDs in the Payload.

How do I check the expiry time (exp) of a JWT?

Paste the token and the tool automatically parses the exp claim, displaying the expiry date and time in human-readable format along with whether it has already expired.

Can this tool verify a JWT signature?

No. Signature verification requires the server's secret key (HS256) or public key (RS256). This tool only decodes the token to inspect its contents.

What is the security risk of alg:none in a JWT header?

alg:none means no signature. Servers that accept it are vulnerable to token forgery attacks where anyone can craft a valid-looking token. Always reject alg:none on the server side.

What is the difference between iat, exp, and nbf claims?

iat (Issued At) is the creation time, exp (Expiration) is the expiry time, and nbf (Not Before) is the earliest valid time. All use Unix timestamps and are defined in RFC 7519.

What is the difference between RS256 and HS256?

HS256 uses a symmetric secret key for both signing and verification. RS256 uses asymmetric keys — private key to sign, public key to verify. RS256 is preferred when sharing verification with external services.

Should I store JWTs in cookies or localStorage?

HttpOnly + Secure cookies are safer against XSS attacks since JavaScript cannot access them. localStorage is vulnerable to XSS. Cookies require CSRF protection, but that's manageable.

What should I do if a JWT is stolen?

JWTs are stateless and hard to revoke by default. Mitigations include token blocklists, short expiry times, and Refresh Token rotation to limit the damage window.

What information should I put in the JWT Payload?

Include only the minimum data needed for authorization: user ID, roles, scopes, issuer. Never include passwords, credit card numbers, or other sensitive data — the Payload is readable by anyone.

What is the difference between an Access Token and a Refresh Token?

Access Tokens have a short lifetime (minutes to an hour) and authenticate API requests. Refresh Tokens have a longer lifetime and are used only to obtain new Access Tokens.

Is my JWT sent to a server when I use this tool?

No. All decoding is performed locally in your browser's JavaScript. You can safely paste production JWTs to inspect their contents.

Dev · Instrument

JWT
디코더

JWT 토큰을 붙여넣으면 Header, Payload, Signature를 즉시 분석합니다

JWT TOKEN 붙여넣기

JWT란?

JWT(JSON Web Token)는 당사자 간 정보를 안전하게 전달하기 위한 토큰 형식입니다. Header.Payload.Signature 세 부분이 점(.)으로 구분되며, 각 부분은 Base64URL로 인코딩됩니다.

📖 JWT 인증 완전 가이드 보기

자주 묻는 질문 (FAQ)

Q. JWT는 암호화되어 있나요?
A. 아니요. JWT는 Base64로 인코딩되어 있을 뿐 암호화가 아닙니다. Payload 내용은 누구나 볼 수 있으므로 민감한 정보를 담지 마세요.

Q. JWT 만료시간(exp)을 어떻게 확인하나요?
A. 토큰을 붙여넣으면 Payload에서 exp 클레임을 자동으로 파싱해 만료 여부와 시간을 표시합니다.

Q. JWT 서명(Signature)을 검증할 수 있나요?
A. 서명 검증은 서버 측 비밀키가 필요합니다. 이 도구는 디코딩만 지원하며 서명 검증은 지원하지 않습니다.

Q. 입력한 JWT가 서버로 전송되나요?
A. 아니요. 모든 디코딩은 브라우저에서만 처리됩니다.

JWT디코더

JWT란?

자주 묻는 질문 (FAQ)

JWT
디코더