Developer guide
What Is a JWT and How Does JWT Decoding Work?
Learn how JWT headers, payloads, signatures, and registered claims work—and why decoding is not verification.
A compact way to carry claims
A JSON Web Token is a compact, URL-safe representation of claims exchanged between parties. A common signed compact JWT has three Base64url-encoded segments separated by dots: a JOSE header, claims payload, and signature. JWTs can be signed or MAC-protected, encrypted as JWE, or explicitly unsecured. Do not assume every JWT is encrypted.
Header, payload, and signature
| Part | Typical contents | Meaning |
|---|---|---|
| Header | alg, typ, kid | Declared token and algorithm metadata |
| Payload | sub, iss, aud, exp, iat | Claims about a subject or context |
| Signature | Cryptographic bytes | Protects integrity only when correctly verified with trusted keys and rules |
Base64url is an encoding suited to URLs; it is not encryption. Anyone who obtains an ordinary signed JWT can generally decode its header and payload.
What common claims mean
sub identifies the subject, iss the issuer, aud an intended audience, exp expiration time, and iat issuance time. Time claims use NumericDate seconds. Their presence does not prove the values are true.
{
"sub": "demo-user",
"iss": "https://example.test",
"aud": "sample-app",
"iat": 1893452400,
"exp": 1893456000
}Decoding is not verification
The JWT Decoder decodes and parses supported three-segment tokens, displays header and payload JSON, and formats supported time claims. It does not fetch issuer metadata, select trusted keys, verify a signature, validate issuer or audience, or authenticate a user. Claims remain untrusted until the consuming application performs the verification its security design requires.
Handle tokens safely
Use synthetic or redacted examples. Do not paste live session tokens, credentials, private keys, or production secrets into an online tool. Review structure with the JSON Formatter & Validator when appropriate, but formatting does not validate identity or authorization. The definitions follow the JWT and JWS specifications; JSON vs CSV: When to Use Each explains the JSON data model.