A JWT (JSON Web Token) is a compact, URL-safe token format for securely transmitting information between parties. It consists of three parts: header (algorithm), payload (claims/data), and signature. JWTs are the standard for API authentication.

Is it safe to decode a JWT?

Decoding a JWT reveals its contents but does not compromise security — the payload is base64-encoded, not encrypted. The security lies in the signature verification. However, never expose JWTs containing sensitive data in URLs or client-side logs.

Claims are statements about the user and metadata. Standard claims include: iss (issuer), sub (subject), exp (expiration), iat (issued at), and aud (audience). Custom claims can contain any application-specific data like user roles.

How long should a JWT token last?

Access tokens should expire in 15-30 minutes for security. Refresh tokens can last 7-30 days. Short-lived access tokens limit damage if compromised, while refresh tokens provide a smooth user experience without frequent re-authentication.

An bhfuil díchódú sábháilte in úsáid anseo ar líne?

Tá go deimhin. Soláthraíonn JavaScript an méid oibre ar fad ag gléas an bhrabhsálaí seo seachas cuig áit ar bith eile lasmuigh.

Gach comhartha atá éagtha chugat cad is brí le seo?

"'Exp' is comhartha chugat maidir leis an díchódú, ní incheaptha go dtug sé logáil leithleach d'aon oibreán a úsáideann freastalaí ar líne do dhífhorbairt.

🎫 Díchódóir JWT

Díchódaigh JSON Web Tokens (JWT) chun breathnú ar an gceanntásc (header), a phálasta (payload) agus a shíniú.

Decodes JSON Web Tokens showing header, payload, and signature without requiring the secret key, for debugging auth flows.

Key Facts

Standardized in RFC 7519 (2015)
80%+ of modern APIs use JWT
Three parts separated by dots (.)
Common algorithms: HS256, RS256

Frequently Asked Questions

What is a JWT?

Compact, URL-safe token with header (algorithm), payload (claims), and signature for API authentication.

Is decoding JWT safe?

Yes — payload is base64-encoded, not encrypted. Security is in signature verification, not content hiding.

What are JWT claims?

Statements about user: iss (issuer), sub (subject), exp (expiration), iat (issued at), aud (audience).

How long should JWT last?

Access tokens: 15-30 min. Refresh tokens: 7-30 days. Short-lived limits damage if compromised.

🎫 Díchódóir JWT

Cad is JSON Web Token (JWT) ann?

Struchtúr JWT

Ceisteanna Coitianta

Key Facts

Frequently Asked Questions

🎫 Díchódóir JWT

Cad is JSON Web Token (JWT) ann?

Struchtúr JWT

Ceisteanna Coitianta

Key Facts

Frequently Asked Questions

Uirlisí forbartha gaolmhara