JWT stands for JSON Web Token, a compact way to pass a set of claims (facts such as "this is user 42, and this token expires at 10:30") between two parties, defined in RFC 7519. Most JWTs are signed, so the receiver can check that nobody changed them. They're widely used as access tokens in OAuth 2.0 and OpenID Connect and in single sign-on.
What a JWT looks like
A signed JWT is three Base64URL-encoded parts joined by dots: header.payload.signature.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.eyJzdWIiOiI0MiIsIm5hbWUiOiJBZGEiLCJpYXQiOjE3OTI0OTEyMDAsImV4cCI6MTc5MjQ5NDgwMH0
.<signature>Decoding the first two parts gives plain JSON:
Header: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "42", "name": "Ada", "iat": 1792491200, "exp": 1792494800 }The header says how the token is signed. The payload holds the claims. The signature is computed over the first two parts with a secret (HS256) or a private key (RS256, ES256), so changing a single character of the payload makes it invalid.
The standard claims
| Claim | Name | Meaning |
|---|---|---|
iss | Issuer | Who created the token, e.g. your identity provider's URL |
sub | Subject | Who the token is about, usually a user ID |
aud | Audience | Which API or app the token is meant for |
exp | Expiration time | After this moment the token must be rejected |
nbf | Not before | Before this moment the token must be rejected |
iat | Issued at | When the token was created |
jti | JWT ID | A unique ID, useful for blocking replays |
Times are NumericDate values: seconds since 1 January 1970 UTC. Paste one into the timestamp converter to see the date, or use the JWT decoder, which shows them as dates and tells you whether the token has expired.
Signed is not encrypted
Anyone who has a signed JWT can read its payload: Base64URL is an encoding, not encryption. Never put passwords, card numbers or other secrets in a JWT. If the contents must be hidden, use an encrypted token (JWE) instead.
Checking a JWT properly
Decoding only shows what a token says; it doesn't prove anything. Before trusting a token, a server must:
- Verify the signature with the expected key, and only accept the algorithm it expects. Never accept
"alg": "none". - Check
expandnbf, allowing at most a minute or so of clock skew. - Check that
issandaudare the values your API expects.
Use a maintained library for this (for example jjwt or Nimbus in Java, jsonwebtoken or jose in Node.js, PyJWT in Python) instead of writing the checks yourself.
Is it safe to paste a token into a decoder?
Treat a valid token like a password until it expires: whoever holds it can call the API as that user. Only paste tokens into tools that decode locally. The JWT decoder on this site runs in your browser and doesn't send the token anywhere. Also keep tokens out of URLs and logs, where they're easily leaked.
Try it: JWT Decoder · Timestamp Converter · Base64 Decoder. Free, no sign-up.