What Is Actually Inside a JWT?

If you've worked with authentication, you've probably seen something resembling this:

xxxxx.yyyyy.zzzzz

That's a JSON Web Token, or JWT.

It looks cryptic at first, but its basic structure is surprisingly simple.

A JWT normally contains three sections:

1. Header

The header contains information about the token itself, such as the signing algorithm and token type.

2. Payload

The payload contains claims.

Depending on the application, these might include things such as a user ID, role, issuer or expiration time.

One important thing to remember: encoded does not mean encrypted.

You shouldn't assume information inside a JWT payload is secret simply because the token looks unreadable.

3. Signature

The signature is used to verify that the token hasn't been altered.

Put the three pieces together and you get the familiar:

header.payload.signature

A quick way to inspect one

While working on Sadevz Tools, I built a small browser-based JWT Decoder for inspecting token contents without needing to set up a project just to decode one.

You can use it here:

JWT Decoder — Decode & Inspect JSON Web Tokens Free | Sadevz

Paste any JWT to instantly view its header, payload, expiration and signature. 100% client-side, nothing leaves your browser.

sadevz.com

It's free and doesn't require an account.

I'm building these utilities around a simple idea: developer tools should sometimes just do one job and get out of your way.

What small developer utility do you find yourself repeatedly searching for?