JWT Header Decoder

JWT Header Decoder

Decode the JWT header to view the signing algorithm and token type. The header determines how the token signature is verified.

JWT Header Structure

The header is the first part of the JWT (before the first dot) and contains metadata about the token:

``json { "alg": "HS256", "typ": "JWT" } `

Header Fields

JWT Header Decoder

`javascript function decodeJWTHeader(token) { const headerPart = token.split('.')[0];

// Base64URL decode const base64 = headerPart.replace(/-/g, '+').replace(/_/g, '/'); const padded = base64 + '=='.slice(0, (4 - base64.length % 4) % 4); const decoded = atob(padded);

const header = JSON.parse(decoded);

// Analyze algorithm security const algorithmInfo = getAlgorithmInfo(header.alg);

return { raw: headerPart, decoded: header, algorithm: algorithmInfo }; }

function getAlgorithmInfo(alg) { const algorithms = { 'HS256': { type: 'HMAC', hash: 'SHA-256', keyType: 'symmetric', secure: true }, 'HS384': { type: 'HMAC', hash: 'SHA-384', keyType: 'symmetric', secure: true }, 'HS512': { type: 'HMAC', hash: 'SHA-512', keyType: 'symmetric', secure: true }, 'RS256': { type: 'RSA', hash: 'SHA-256', keyType: 'asymmetric', secure: true }, 'RS384': { type: 'RSA', hash: 'SHA-384', keyType: 'asymmetric', secure: true }, 'RS512': { type: 'RSA', hash: 'SHA-512', keyType: 'asymmetric', secure: true }, 'ES256': { type: 'ECDSA', curve: 'P-256', keyType: 'asymmetric', secure: true }, 'ES384': { type: 'ECDSA', curve: 'P-384', keyType: 'asymmetric', secure: true }, 'ES512': { type: 'ECDSA', curve: 'P-521', keyType: 'asymmetric', secure: true }, 'PS256': { type: 'RSA-PSS', hash: 'SHA-256', keyType: 'asymmetric', secure: true }, 'none': { type: 'None', keyType: 'none', secure: false, warning: 'INSECURE!' } };

return algorithms[alg] || { type: 'Unknown', secure: false }; } ``

Algorithm Comparison