What a JWT Actually Is

A JSON Web Token is three base64url-encoded sections separated by dots: a header describing the token, a payload containing the actual claims (like a user ID or an expiry time), and a signature. Written out it looks like a long jumble of characters, but it is really just three small pieces of encoded JSON stuck together with a signature on the end.

The header and payload are base64url encoded, not encrypted, which means anyone can decode them with no key at all, the same way anyone can decode plain Base64. This is by design: a JWT is meant to be readable, its integrity is what the signature protects, not its confidentiality. Sensitive data that genuinely needs to stay secret should not be placed in a JWT payload on the assumption that it is hidden, because it is not.

The signature exists so that whoever is relying on the token can confirm it was issued by a trusted source and has not been tampered with since. Verifying it requires the issuer's secret or public key, something this or any decoder run by a third party does not have. Without verification, nothing stops someone from handing you a token with a modified payload, which is exactly what signature verification is designed to catch.

• sub: the subject the token is about, typically a user ID.
• iat: issued at, when the token was created.
• exp: expiry, after which the token should no longer be accepted.
• iss and aud: which system issued the token and which system it is intended for.

JWT Decoder splits a token into its header and payload and shows both as formatted JSON, entirely in your browser. Paste in a JWT from an API you are working with to see exactly what claims it carries, keeping in mind this only decodes the token and makes no claim about whether its signature is actually valid.