# Tokens & 2FA

Tokens carry proof of identity between systems, and two-factor authentication (2FA) adds a short-lived code to a password. Anyone can decode a signed JSON Web Token (RFC 7519) and read its claims, so it must not hold secrets. Authenticator apps using TOTP (RFC 6238) usually show a new six-digit code every 30 seconds.

## Tools

- JWT Decoder (Coming soon): Decode a JSON Web Token to read its header, payload claims and expiry time.

---

Category: [Security & Encoding Tools](https://techolm.com/security-tools)