What Is JWT and How to Decode It - Complete Guide
Learn what JSON Web Tokens are, how they work, and how to decode them. Understand JWT header, payload, and signature.
What Is a JWT?
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe token format used for securely transmitting information between parties. JWTs are widely used for authentication and authorization in web applications, APIs, and single sign-on (SSO) systems.
JWT Structure
A JWT consists of three parts separated by dots: header.payload.signature. Each part is Base64URL-encoded.
- Header — Contains the token type (
"typ": "JWT") and the signing algorithm ("alg": "HS256"or"RS256"). - Payload — Contains claims — statements about the user and metadata. Common claims include
sub(subject/user ID),exp(expiration time),iat(issued at), andiss(issuer). - Signature — Created by signing the encoded header and payload with a secret key. This ensures the token has not been tampered with.
How JWT Authentication Works
When a user logs in, the server creates a JWT containing user information and signs it with a secret. The client stores this token (usually in localStorage or an httpOnly cookie) and sends it with every subsequent request in the Authorization: Bearer <token> header. The server verifies the signature to authenticate the request without querying a database.
Decode a JWT
Use our JWT Decoder to paste any JWT and instantly see its decoded header, payload, and expiration status. The decoder runs entirely in your browser — your tokens are never sent to any server.
Security Best Practices
- Always set a short expiration time (
exp) and use refresh tokens for long sessions. - Never store sensitive data in the payload — it is only encoded, not encrypted.
- Use
RS256(asymmetric) for public-facing APIs so only the server can sign tokens. - Validate the
issandaudclaims to prevent token misuse across services.