You can use Utilso to decode, verify, and generate JWTs. Work
completely offline. Stop using online website and paste sensitive
JSON Web Token is a proposed Internet standard for creating data
with optional signature and/or optional encryption whose payload
holds JSON that asserts some number of claims. The tokens are
signed either using a private secret or a public/private key.
What is JSON Web Token?
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely
transmitting information between parties as a JSON object. This
information can be verified and trusted because it is digitally
signed. JWTs can be signed using a secret (with the
HMAC algorithm) or a public/private key pair using
RSA or ECDSA.
Although JWTs can be encrypted to also provide secrecy between
parties, we will focus on signed tokens. Signed tokens can
verify the integrity of the claims contained within it, while
encrypted tokens hide those claims from other parties. When
tokens are signed using public/private key pairs, the signature also
certifies that only the party holding the private key is the one that
When should you use JSON Web Tokens?
Here are some scenarios where JSON Web Tokens are useful:
Authorization: This is the most common scenario
for using JWT. Once the user is logged in, each subsequent request
will include the JWT, allowing the user to access routes,
services, and resources that are permitted with that token. Single
Sign On is a feature that widely uses JWT nowadays, because of its
small overhead and its ability to be easily used across different
Information Exchange: JSON Web Tokens are a good
way of securely transmitting information between parties. Because
JWTs can be signed—for example, using public/private key pairs—you
can be sure the senders are who they say they are. Additionally,
as the signature is calculated using the header and the payload,
you can also verify that the content hasn't been tampered with.
What is the JSON Web Token structure?
In its compact form, JSON Web Tokens consist of three parts separated
by dots (.), which are:
Therefore, a JWT typically looks like the following.
Let's break down the different parts.
The header typically consists of two parts: the type of the token,
which is JWT, and the signing algorithm being used, such as HMAC
SHA256 or RSA.
Then, this JSON is Base64Url encoded to form the first part of the
The second part of the token is the payload, which contains the
claims. Claims are statements about an entity (typically, the user)
and additional data. There are three types of claims: registered,
public, and private claims.
Registered claims: These are a set of predefined
claims which are not mandatory but recommended, to provide a set
of useful, interoperable claims. Some of them are: iss (issuer),
exp (expiration time), sub (subject), aud (audience), and others.
Public claims: These can be defined at will by
those using JWTs. But to avoid collisions they should be defined
in the IANA JSON Web Token Registry or be defined as a URI that
contains a collision resistant namespace.
Private claims These are the custom claims
created to share information between parties that agree on using
them and are neither registered or public claims.
An example payload could be:
The payload is then Base64Url encoded to form the
second part of the JSON Web Token.
Do note that for signed tokens this information, though protected
against tampering, is readable by anyone. Do not put secret
information in the payload or header elements of a JWT unless it is
To create the signature part you have to take the encoded header, the
encoded payload, a secret, the algorithm specified in the header, and
For example if you want to use the HMAC SHA256 algorithm, the
signature will be created in the following way:
The signature is used to verify the message wasn't changed along the
way, and, in the case of tokens signed with a private key, it can also
verify that the sender of the JWT is who it says it is.
Putting all together
The output is three Base64-URL strings separated by dots that can be
easily passed in HTML and HTTP environments, while being more compact
when compared to XML-based standards such as SAML.
The following shows a JWT that has the previous header and payload
encoded, and it is signed with a secret.
If you want to play with JWT and put these concepts into practice, you
can use Utilso Debugger to decode, verify, and generate JWTs.