JWT Decoder & Editor
Local processingStandards, sources and review dates
- JWT security BCP · RFC 8725 · February 2020 · Reviewed
Decoding does not verify authenticity. Verification must constrain algorithms, keys, issuer, audience, token purpose and time claims. Review interval: 90 days.
Decoded claims are untrusted
Decoding does not verify a signature. Follow RFC 8725: allow only expected algorithms and trusted keys, then validate issuer, audience, expiry and token purpose in your application.
Paste a JWT token