🪪 Security

JWT Claims Explainer

Lists all RFC 7519 registered claims (iss, sub, aud, exp, nbf, iat, jti) with descriptions and basic validation.

JWT (header.payload.sig)

Decoda o payload e explica cada claim conforme RFC 7519. A assinatura NÃO é validada.

Claims explained

—

Reading what is inside a JWT

A JWT has three parts separated by dots: header, payload and signature. The first two are just base64url — they are not encryption. Which means anyone holding the token can read the contents, and that is the reason never to put a password, a national ID or sensitive data in the payload. The signature hides nothing; it only guarantees that nobody altered what is written.

Paste the token and the page decodes the payload, lists the registered claims with an explanation of each, and converts the time fields into readable dates. exp additionally gets a verdict: expired, or how many minutes are left. Claims outside the registered set — role, tenant, email, scope — are listed separately, as public or private claims.

Two things are deliberately out of scope. The signature is not verified: that would require the secret or the issuer's public key, and neither should travel to a web page. And the reading is local, in your own browser — no token is sent to any server, which matters because a JWT pasted into an online tool is, in practice, an exposed credential. Even so, avoid pasting a production token that is still valid.

Frequently asked questions

Is decoding the same as validating?

No, and confusing the two is a common security failure. Decoding shows the content; validating means recomputing the signature with the key, checking exp and nbf, and verifying iss and aud. An attacker can swap the payload freely — only signature validation catches that.

My token has accented characters and decoding failed. Why?

The browser function that decodes base64 works on latin-1 bytes, so a payload with multibyte characters can break it. That is a limitation of decoding in the browser, not of the token. In those cases, decode on the backend or with a library that handles UTF-8 properly.

Why does exp appear as an enormous number?

Because it is a Unix timestamp: seconds since 1 January 1970. The page already converts it to a date and time next to the raw value. Watch out when minting tokens: some environments use milliseconds, and an exp in milliseconds lands in the year 55000 — meaning the token never expires.

Related Tools

🔐

WebAuthn Options Explainer

Explains each PublicKeyCredentialCreationOptions field (attachment, userVerification, residentKey) for developers.

🔐

JWT Secret Strength

Measures the strength of an HMAC JWT secret: byte length, approximate entropy and rating.

🔐

Password Generator

Generate strong, random passwords with custom length, uppercase letters, numbers and symbols. Generated in the browser — no data leaves your device.

🛂

CORS Preflight Explainer

Given a CORS request method and headers, shows whether it triggers an OPTIONS preflight and explains why.

🛡️

Basic CSP Evaluator

Evaluates a Content-Security-Policy directive reporting unsafe-inline, unsafe-eval or wildcard issues.

🌐

CORS Config Validator

Validate a CORS configuration (allowed origins or *), checking the format and duplicates. Useful for safely configuring APIs and web servers.