Skip to content

Tokens & 2FA

Tokens carry proof of identity between systems, and two-factor authentication (2FA) adds a short-lived code to a password. Anyone can decode a signed JSON Web Token (RFC 7519) and read its claims, so it must not hold secrets. Authenticator apps using TOTP (RFC 6238) usually show a new six-digit code every 30 seconds.

Tools

  • JWT Decoder

    Decode a JSON Web Token to read its header, payload claims and expiry time.

    Coming soon