JWT decoder: read the header, payload and expiry

What is a JWT?

A JSON Web Token (JWT) is a compact string used to carry claims between a client and a server. Applications commonly use it as a session or access token: after you log in, the server hands you a token and you send it back with later requests. A JWT is encoded, not encrypted, so anyone holding it can read its contents. That is why a decoder is useful, and why secrets should never be placed in a payload.

The three parts

A JWT is three Base64url strings separated by dots: header.payload.signature.

• Header: JSON describing the token, usually the signing algorithm (alg) and the type (typ).
• Payload: JSON with the claims, such as who the token is about and when it expires.
• Signature: bytes produced by the issuer over the first two parts. Only a server holding the right key can verify it. This tool does not verify signatures.

Common claims

• iss: issuer, who created the token.
• sub: subject, usually a user ID.
• aud: audience the token is meant for.
• exp: expiry time, in seconds since the Unix epoch.
• nbf: not before, the token is not valid until this time.
• iat: issued at.
• jti: a unique token ID.

The three time claims are plain Unix timestamps, so this tool converts them to local time and UTC and tells you whether the token has expired.

JWTs in web CTF challenges

Web challenges often hand you a JWT as a session cookie or an Authorization header. The first step is simply to read it: which claims does the server rely on, which algorithm is declared, and does anything look like an internal role or user ID? Decoding takes seconds and tells you what the application stores client-side. Beginners often discover that the payload is readable by anyone, which is the core lesson of the format. For write-ups and bug reports, the observations list gives you neutral points to document, such as a missing expiry or a very long lifetime.

Once you have read the token, the usual CTF attacks are short to list. Set alg to none and drop the signature, and see if the server still accepts it. Try cracking a weak HS256 secret offline with hashcat (mode 16500) or John the Ripper. If the header carries a kid, check whether it is used in a file path or SQL query. If the server expects RS256, try signing an HS256 token with its public key as the HMAC secret. This page only decodes, so you will need another tool, or a few lines of Python, to build the forged token.

When to use this, and when to use jwt.io or CyberChef

Use this page when you only need to read a token and want to be sure it stays in your browser: the script makes no network requests, so a token from a client engagement or a live CTF never leaves your machine. It also converts exp, nbf and iat to readable times and flags alg: none, a missing expiry and lifetimes over 30 days.

Use jwt.io when you need to verify a signature or re-sign an edited token with a key you hold; this page can do neither. Use CyberChef when the token is one step in a longer chain, for example a JWT inside a Base64 cookie inside a URL parameter. For attacking tokens, jwt_tool automates the tampering and cracking checks above.

Related on CTF7

• Encoder / decoder for Base64, hex and URL encoding.
• Learn for beginner-friendly CTF guides.
• Practice on our practice event, Ouroboros CTF.