Learn the essentials
Understanding JWT Decoder
A JSON Web Token normally contains three dot-separated parts: a header, a payload, and a signature. Decoding reveals readable claims from the first two parts; it does not prove that the token is authentic.
JWT structure
The header describes the token type and signing algorithm. The payload contains claims. The signature is created by the issuer and must be verified with the correct key by a trusted application.
- Header: token metadata such as alg and typ
- Payload: claims such as sub, iss, aud, and exp
- Signature: integrity check performed by the receiving system
Common claims
The exp claim is an expiration time expressed as Unix seconds. iss identifies the issuer, aud describes the intended audience, and sub identifies the subject represented by the token.
Decoding is not verification
Anyone can construct a string that looks like a JWT. Never treat decoded claims as trustworthy until the signature, issuer, audience, algorithm, and time-based claims have been validated by the application handling authentication.