A JSON Web Token (JWT) has three parts separated by dots: header.payload.signature.
- Header — usually algorithm (
alg) and type. - Payload — claims like
sub,exp, roles, or tenant IDs. - Signature — proves the token was issued by someone holding the signing key.
Decoding vs verifying
Anyone can Base64URL-decode the header and payload. That is useful for debugging, but it does not prove authenticity. Always verify signatures in your backend or trusted library.
Inspect tokens with the JWT Decoder, convert exp values in the Timestamp Converter, and read related encoding in the Base64 guide.
FAQ
Is decoding a JWT enough for auth?
No. Decoding only reads claims. Servers must verify the signature with the correct key and enforce exp, aud, and iss.
What encoding do JWT parts use?
Each segment is Base64URL-encoded JSON (except the signature bytes). That is why tokens look opaque but decode easily.