A JWT (JSON Web Token) is a compact, URL-safe token format for securely transmitting information between parties. It consists of three parts: header (algorithm), payload (claims/data), and signature. JWTs are the standard for API authentication.

Is it safe to decode a JWT?

Decoding a JWT reveals its contents but does not compromise security — the payload is base64-encoded, not encrypted. The security lies in the signature verification. However, never expose JWTs containing sensitive data in URLs or client-side logs.

Claims are statements about the user and metadata. Standard claims include: iss (issuer), sub (subject), exp (expiration), iat (issued at), and aud (audience). Custom claims can contain any application-specific data like user roles.

How long should a JWT token last?

Access tokens should expire in 15-30 minutes for security. Refresh tokens can last 7-30 days. Short-lived access tokens limit damage if compromised, while refresh tokens provide a smooth user experience without frequent re-authentication.

Je li sigurno ovdje dekodirati JWT?

Da! Ovaj alat radi 100% lokalno u vašem pregledniku koristeći JavaScript. Vaš token nikada ne napušta vaš uređaj niti se šalje na mrežu.

Što znači istek tokena?

U podacima (payloadu), polje 'exp' označava vremensku oznaku (timestamp) kada certifikat prestaje vrijediti, nakon čega ga poslužitelj mora odbiti.

🎫 JWT Dekoder

Dekodirajte JSON Web Tokene (JWT) kako biste pregledali zaglavlje (header), podatke (payload) i potpis.

Decodes JSON Web Tokens showing header, payload, and signature without requiring the secret key, for debugging auth flows.

Key Facts

Standardized in RFC 7519 (2015)
80%+ of modern APIs use JWT
Three parts separated by dots (.)
Common algorithms: HS256, RS256

Frequently Asked Questions

What is a JWT?

Compact, URL-safe token with header (algorithm), payload (claims), and signature for API authentication.

Is decoding JWT safe?

Yes — payload is base64-encoded, not encrypted. Security is in signature verification, not content hiding.

What are JWT claims?

Statements about user: iss (issuer), sub (subject), exp (expiration), iat (issued at), aud (audience).

How long should JWT last?

Access tokens: 15-30 min. Refresh tokens: 7-30 days. Short-lived limits damage if compromised.

🎫 JWT Dekoder

Što je to JSON Web Token (JWT)?

Struktura JWT-a

Često Postavljana Pitanja

Key Facts

Frequently Asked Questions

🎫 JWT Dekoder

Što je to JSON Web Token (JWT)?

Struktura JWT-a

Često Postavljana Pitanja

Key Facts

Frequently Asked Questions

Povezani razvojni alati