0918.us

JWT Explained: What Is a JSON Web Token and How to Decode It

2026-07-21

JSON Web Tokens (JWT) are everywhere in modern web development. If you have ever logged into a web app, called a REST API with an authorization header, or implemented single sign-on, you have probably encountered JWTs. This guide explains what they are, how they work, and how to inspect them using a JWT Decoder.

What Is a JWT?

A JSON Web Token is a compact, URL-safe token format used to transmit claims between two parties. The claims are JSON objects that contain information about the user, the token's expiration, the issuer, and any custom data the application needs. JWTs are digitally signed, which means the receiver can verify that the token was created by a trusted sender and has not been tampered with.

JWTs are commonly used for:

  • Authentication — after a user logs in, the server issues a JWT. The client includes it in subsequent requests to prove who they are.
  • Information exchange — JWTs can securely transmit data between services because the signature confirms the data has not been modified.
  • Session management — stateless sessions using JWTs mean the server does not need to store session data; everything is encoded in the token.

JWT Structure: Header, Payload, Signature

Every JWT has three parts separated by dots, each Base64URL-encoded:

xxxxx.yyyyy.zzzzz

Header — contains metadata about the token: the signing algorithm (typically HS256 or RS256) and the token type ("JWT").

Payload — contains the claims. Standard claims include sub (subject — usually the user ID), iat (issued at), exp (expiration), and iss (issuer). Custom claims hold application-specific data like roles or permissions.

Signature — created by taking the encoded header and payload, combining them with a secret key, and signing them using the algorithm specified in the header. The signature is what prevents tampering — changing any part of the header or payload would invalidate the signature.

How to Decode a JWT

Use our JWT Decoder to inspect any JWT instantly. Paste the token into the tool and it will decode the header and payload into readable JSON. This is useful for:

  • Debugging authentication issues — check the exp claim to see if the token has expired
  • Inspecting claims — verify what data the token contains
  • Learning — paste example JWTs to understand how they are structured

Note: decoding only reads the Base64URL-encoded data. It does not verify the signature. Signature verification requires the secret key (for HMAC algorithms) or the public key (for RSA/ECDSA algorithms), which the decoder does not have.

Security Considerations

  • Never put sensitive data in the payload — the payload is encoded, not encrypted. Anyone with the token can decode and read it.
  • Always validate the signature server-side — never trust a JWT without verifying its signature on the server where the secret is stored.
  • Set appropriate expiration times — short-lived tokens (15–60 minutes) limit the damage if a token is stolen. Use refresh tokens for longer sessions.
  • Use HTTPS — transmit JWTs only over HTTPS to prevent interception.

Related Tools

Since JWT segments are Base64URL-encoded, the Base64 Text Encoder/Decoder can decode individual parts. The Hash Generator is useful for understanding the hashing algorithms used in JWT signing. And if you are working with API authentication, the URL Encoder/Decoder helps with encoding query parameters and request data.