JWT Decoder & Token Inspector

JWT Structure, Claims and Browser Authentication Safety

A JSON Web Token is three Base64URL-encoded segments separated by dots: header, payload and signature. The header names the signing algorithm, typically HS256 or RS256. The payload carries claims — sub for the subject, iat for issued-at, exp for expiry, plus any custom claims your application adds such as roles or tenant identifiers. The signature is computed over the first two segments using a secret or private key.

Crucially, the first two segments are encoded, not encrypted. Anyone holding a token can read them, which is why a JWT must never carry passwords, card data or personal information you would not put in a log. Decoding is the fastest way to debug an authentication failure: check whether exp has already passed, whether the audience and issuer match what your API expects, and whether the expected role claim is actually present. Verifying the signature requires the key and belongs on your server — treat any token you paste anywhere as potentially compromised and rotate it if it is a live credential.

Frequently asked questions