What is JWT? How to Decode and Inspect JWT Tokens

What is JWT?

A JSON Web Token (JWT) is a compact, self-contained way to securely transmit information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

JWTs are commonly used for:

• Authentication – After login, each request includes the JWT to verify the user
• Information Exchange – Securely transmit data between parties

JWT Structure

A JWT consists of three parts separated by dots: Header.Payload.Signature

1. Header

The header typically contains the token type (JWT) and the signing algorithm (e.g., HS256).

2. Payload

The payload contains the claims — statements about an entity (user) and additional data.

3. Signature

The signature is used to verify the token hasn't been tampered with.

Common JWT Claims

• iss – Issuer
• sub – Subject (user ID)
• aud – Audience
• exp – Expiration time
• iat – Issued at
• jti – JWT ID

Security Tips

1. Never put sensitive data in JWT payload — it can be decoded by anyone
2. Always verify the signature server-side
3. Set appropriate expiration times
4. Use HTTPS to prevent token interception
5. Rotate secrets regularly

Try It Now

Use our JWT Decoder to decode any JWT token instantly in your browser. A JWT is almost always sent as a bearer token, so if you're wiring up API auth, our explainer on what a bearer token is covers how it travels in the Authorization header. Deciding how to store auth in the first place? Compare JWT vs session cookies — and to understand token lifetimes, see when a JWT expires.