JWT Decoder

What is a JWT?

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

The Three Parts of a JWT

A JWT is logically separated by two dots (.) into three distinct parts:

1. Header: Typically consists of two parts: the type of the token (JWT) and the signing algorithm being used (e.g., HMAC SHA256 or RSA).
2. Payload (Claims): Contains the claims. Claims are statements about an entity (typically, the user) and additional data (e.g., user ID, expiration time, issuer).
3. Signature: Used to verify the message wasn't changed along the way. To create the signature part, you have to take the encoded header, the encoded payload, a secret, and sign it using the algorithm specified in the header.

Security Warning

Never put sensitive information inside a JWT payload. The Header and Payload are merely Base64Url encoded, not encrypted! As you can see using this tool, anyone who captures your JWT can instantly read everything inside the payload (like an email address or internal user ID). The signature only proves the data wasn't tampered with, it does not hide the data.