Token
🔐
Decoded header, payload, and signature will appear hereFrequently asked questions
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It is widely used for authentication — after logging in, a server issues a JWT that the client sends with every request to prove its identity.
What are the three parts of a JWT?
A JWT has three base64url-encoded parts separated by dots: the Header (algorithm and token type), the Payload (claims like user ID and expiry), and the Signature (used to verify the token wasn't tampered with). Only the signature is secret — the header and payload are just encoded, not encrypted.
What is the difference between HS256, HS384, and HS512?
All three use HMAC (Hash-based Message Authentication Code) with a shared secret key. The number refers to the SHA hash size in bits — 256, 384, or 512. HS256 is the most widely used. Larger hash sizes are more collision-resistant but the practical security difference is minimal for most applications.
Is it safe to sign JWTs in the browser?
For testing and development purposes, yes. In production, JWT signing should happen on the server where the secret key is never exposed to clients. Never use a real production secret in a browser-based tool.
What are common JWT claims?
Standard claims include: iss (issuer), sub (subject/user ID), aud (audience), exp (expiry timestamp), iat (issued at), and nbf (not before). Most authentication systems like Auth0, Firebase, and Supabase use these.