JWT Token Decode

What is a JWT token?

A JSON Web Token (JWT) is a compact and secure way to transmit information between two parties as a JSON object. JWT tokens are commonly used for authentication and authorization in modern web applications and APIs. A typical JWT contains three parts: header, payload, and signature.

How to decode a JWT token?

To decode a JWT token, paste it into the decoder tool. The tool automatically parses the Base64URL-encoded header and payload and converts them into readable JSON so developers can inspect claims and debug authentication flows.

What is the structure of a JWT token?

A JSON Web Token is composed of three parts separated by dots: header.payload.signature. The header contains metadata about the token, the payload contains claims, and the signature is used to verify that the token has not been altered.

What is the JWT payload?

The payload is the second part of a JSON Web Token and contains the claims carried by the token. Claims can include user identity, permissions, expiration time, and other metadata. Because the payload is encoded and not encrypted, sensitive information should not be stored inside it.

What is the JWT header?

The JWT header is the first part of a JSON Web Token and contains metadata such as the signing algorithm and token type. For example, it often includes fields like alg and typ before being encoded with Base64URL.

How to verify a JWT signature?

To verify a JWT signature, the server recalculates the signature using the encoded header, payload, and the correct secret key or public key. If the calculated signature matches the token signature, the JWT is considered valid.

What are JWT claims?

JWT claims are pieces of information stored inside the payload of a JSON Web Token. They can describe user identity, expiration time, issuer, audience, and custom application data. Common registered claims include iss, sub, aud, and exp.

What does exp mean in a JWT token?

The exp claim represents the expiration time of the token. It defines the exact moment when the token becomes invalid and is usually stored as a Unix timestamp.