A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519 for securely transmitting claims between parties. It consists of three Base64URL-encoded parts separated by dots: Header (algorithm and token type), Payload (claims such as user ID, expiration, and issuer), and Signature (cryptographic verification hash). JWTs are the standard for API authentication, single sign-on (SSO), and stateless session management in modern web applications.
What is a JWT?
A JSON Web Token (JWT) is an open standard (RFC 7519) for securely transmitting information between parties as a compact, URL-safe string. JWTs are the backbone of modern authentication: when you log into an app, the server issues a JWT that your client sends with every subsequent request to prove your identity.
A JWT looks like this: xxxxx.yyyyy.zzzzz — three Base64URL-encoded parts separated by dots.
What are the three parts of a JWT?
Every JWT consists of three parts:
- Header — Contains the signing algorithm (
alg, e.g. RS256, HS256) and token type (typ, usually "JWT"). May also include a key ID (kid) for key rotation. - Payload — Contains the claims: data about the user and the token itself. Standard claims include
sub(subject/user ID),iss(issuer),exp(expiration),iat(issued at). Custom claims can contain anything: roles, permissions, email, etc. - Signature — Created by signing the encoded header and payload with a secret (HMAC) or private key (RSA/ECDSA). This ensures the token hasn't been tampered with. Verification requires the corresponding secret or public key.
Why Decode JWTs Locally?
JWTs often contain sensitive information: user IDs, email addresses, roles, permissions, and internal service identifiers. Pasting these tokens into online tools that send data to their servers creates a security risk — the token could be logged, cached, or intercepted.
This tool decodes everything using JavaScript's native atob() function directly in your browser. No network requests are made. You can verify this by opening your browser's DevTools Network tab while using the tool.
Need to encode or decode Base64 data? Try our Base64 encoder/decoder. For converting JSON between formats, check the JSON ↔ YAML converter.