JWT Decoder Guide: Understanding JSON Web Tokens

What Is a JWT?

JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a JSON object. JWTs are compact, URL-safe, and commonly used for authentication and authorization. A JWT looks like three Base64URL-encoded segments separated by dots: header.payload.signature.

JWT Structure

• Header — contains the token type (JWT) and the signing algorithm (e.g., HS256, RS256)
• Payload — contains the claims: registered claims (iss, sub, exp), public claims, and private claims
• Signature — created by signing the header and payload with a secret key or private key

Common JWT Claims

• iss — issuer: who created the token
• sub — subject: who the token is about (usually a user ID)
• exp — expiration: when the token expires (Unix timestamp)
• iat — issued at: when the token was created
• aud — audience: who should accept the token

Security Considerations

JWTs are signed, not encrypted. Anyone can decode the header and payload — they are just Base64URL-encoded JSON. The signature only proves the token has not been tampered with. Never store sensitive data in JWT payloads unless the token is also encrypted (JWE). Always validate the signature, expiration, and audience on your server.

Try Our JWT Decoder

Paste any JWT into our JWT Decoder to instantly see the decoded header and payload. All decoding happens client-side — your tokens never leave your browser.

---

Originally published at devtools.systems