What Is a JWT (JSON Web Token)?
A JSON Web Token (JWT) is a claims format defined by RFC 7519. It is commonly carried inside a signed JSON Web Signature (JWS), using an HMAC secret or an asymmetric private key, or inside an encrypted JSON Web Encryption (JWE). Decoding only reveals the JSON; a token becomes trustworthy only after the receiving application verifies its signature and validates its issuer, audience, algorithm, and timing rules.
JWTs are frequently used for identity and API authorization. A client may send a bearer token in an HTTP Authorization header, after which the resource server verifies the token before reading its claims. Not every OAuth access token is a JWT—some providers issue opaque reference tokens that cannot be decoded locally.
JWT Structure: Header, Payload, Signature
Header
Algorithm & token type
Payload
Claims & user data
Signature
Cryptographic verification
Common JWT Claims and JOSE Header Fields
| Claim | Full Name | Type | Description |
|---|---|---|---|
| sub | Subject | string | Identifies the principal that is the subject of the JWT — typically a user ID. |
| iss | Issuer | string | Identifies the authentication server that issued the token. Usually a URL (e.g., https://auth.example.com). |
| aud | Audience | string / array | Identifies intended recipients. A resource server must confirm that it is an allowed audience. |
| exp | Expiration Time | number | NumericDate after which the token must not be accepted. Short lifetimes reduce exposure if a token leaks. |
| iat | Issued At | number | NumericDate indicating when the token was issued. Applications may use it in token-age policies. |
| nbf | Not Before | number | NumericDate before which the token must not be accepted. Clock-skew policy is application-specific. |
| jti | JWT ID | string | Unique token identifier that can support replay detection or revocation when the application tracks it. |
| alg | Algorithm | string | In the header — specifies the algorithm used to sign the token. E.g., HS256, RS256, ES256. |
| kid | Key ID | string | In the header — identifies which key from a JWKS (JSON Web Key Set) was used to sign the token. |
Decoding Is Not Token Validation
This tool decodes
Compact structure, Base64URL text, JSON objects, claim values, and exp or nbf timing.
It does not verify
Cryptographic signatures, trusted issuers, accepted audiences, algorithm policy, revocation, or application permissions.
Your server must check
The signature with a trusted key, an algorithm allowlist, iss, aud, exp, nbf, and any application-specific claims.
Security Reminder
JWT payloads are Base64URL encoded, not encrypted. Anyone with access to a JWT can read its contents simply by decoding it — exactly as this tool does. Never store passwords, API secrets, private keys, internal system paths, or sensitive personal information inside JWT payload claims. If a JWT is intercepted or leaked, all its claims are immediately readable without any key or password.
For sensitive data transmission, use JWE (JSON Web Encryption) or ensure tokens are only transmitted over TLS/HTTPS and expire quickly (short exp values).
Verifiers should select allowed algorithms from trusted server configuration rather than accepting the header's alg value blindly. Treat alg: none as unsecured unless an explicitly designed protocol requires it.
Continue Your Developer Workflow
Encode or inspect individual token segments with the Base64 Encoder & Decoder, validate copied claims in the JSON Formatter & Validator, convert NumericDate values with the Unix Timestamp Converter, or prepare URL-safe values using the URL Encoder & Decoder.
For broader context on endpoints, requests, authentication, and bearer tokens, read the plain-language API explainer.
JWT Security and Format References
The token claims format is defined by RFC 7519, while compact signatures are defined by RFC 7515. Implementation guidance is available in the JWT Best Current Practices (RFC 8725). External references open in a new tab.