What Is a JWT and How to Decode One
If you've ever logged into a web application, there's a good chance you received a JWT. These tokens are now the standard for authentication in REST APIs and single-page apps. This guide explains what a JWT contains, how to read one, and what the security implications are.
What Is a JWT?
A JWT (JSON Web Token) is a compact, URL-safe string that represents a set of claims — facts about a user or session. A typical JWT looks like this:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFsaWNlIiwiaWF0IjoxNzE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
It has exactly three parts separated by dots (.):
Header
Red portion
Algorithm and token type
Payload
Purple portion
Claims — user data
Signature
Blue portion
Verification integrity check
Decoding the Three Parts
1. Header
Base64URL-decoded, the header is a JSON object specifying the algorithm used to sign the token:
{
"alg": "HS256", // HMAC-SHA256
"typ": "JWT"
} 2. Payload (Claims)
The payload contains the claims — the actual data the token carries:
{
"sub": "1234567890", // Subject (user ID)
"name": "Alice",
"email": "[email protected]",
"role": "admin",
"iat": 1716239022, // Issued at (Unix timestamp)
"exp": 1716325422 // Expiry (Unix timestamp)
} 3. Signature
The signature is created by the server using the secret key: HMAC-SHA256(base64Header + "." + base64Payload, secret). The server verifies every incoming token by recomputing this signature. If the payload was tampered with, the signature won't match and the token is rejected.
Standard JWT Claims
| Claim | Name | Description |
|---|---|---|
| sub | Subject | Who the token is about (usually user ID) |
| iss | Issuer | Which server issued the token |
| aud | Audience | Who the token is intended for |
| exp | Expiration | Unix timestamp when the token expires |
| iat | Issued At | Unix timestamp when the token was created |
| jti | JWT ID | Unique identifier — prevents replay attacks |
Key Security Facts
JWT payloads are NOT encrypted
The payload is Base64URL encoded — not encrypted. Anyone who has the token can read the payload by decoding it. Never put sensitive data (passwords, full credit card numbers) in a JWT payload.
Tokens can't be invalidated before expiry
Unlike server-side sessions, a JWT remains valid until it expires — even if the user logs out or changes their password. Set short expiry times (15 minutes to 1 hour) and use refresh tokens for longer sessions.
Algorithm confusion attacks
Some libraries accept "alg: none" which skips signature verification. Always explicitly specify which algorithms your verifier accepts.
How to Decode a JWT
Use our JWT Decoder to paste any JWT and instantly see the decoded header and payload — with human-readable timestamps for iat and exp. Everything runs in your browser — the token never leaves your device.
Decode a JWT token instantly — free