Understanding JSON Web Tokens (RFC 7519)
JSON Web Tokens (JWT) are a compact, URL-safe means of representing claims to be transferred between two parties. A standard token consists of three distinct parts separated by dots (.):
- Header: Declares the cryptographic signing algorithm (such as HMAC SHA256 or RSA) and token type (typically JWT).
- Payload: Encodes the user identity, session state, permissions, issued-at time (
iat), and expiration (exp). - Signature: Prevents tampering by hashing the header and payload with a private secret key.
Zero-Server Privacy: DevNova inspects your tokens strictly within the browser memory context using base64url decoding. Your authentication credentials are never sent to external servers.
The Structure of JSON Web Tokens (RFC 7519)
JSON Web Tokens (JWT) are an open standard representing verifiable claims between two parties. Compact and URL-safe, JWTs are the dominant authentication standard for Single Page Applications (SPAs) and microservices. A complete token is divided into three distinct segments separated by periods: Header, Payload, and Signature.
Standard Registered Claims Explained
The payload contains the core authorization claims: sub (subject/user identifier), iat (issued-at timestamp), exp (expiration timestamp), and iss (issuer authority). DevNova automatically decodes epoch timestamps into human-readable local calendar times, allowing developers to inspect session validity at a glance.
Frequently Asked Questions
Is it secure to paste production JWTs here? Yes. DevNova is engineered with zero-server architecture. All base64url decoding occurs strictly in your local device RAM. No tokens, secrets, or headers are ever transmitted across network sockets or recorded in server logs.
Can DevNova sign or tamper with tokens? DevNova is an inspector and decoder. Verifying cryptographic signatures requires secret or public keys, which should always remain secure on your backend authentication servers.