What is JWT — JSON Web Token explained
What is a JWT (JSON Web Token): header.payload.signature structure, claims, and how to decode a token online in the browser.
JWT (JSON Web Token) is a compact format for passing claims between parties as a dot-separated string of three parts: header, payload, and signature. All three segments are Base64URL-encoded, so the token can travel safely in URLs, headers, and cookies.
The header describes the signing algorithm and token type, the payload holds claims — for example, the user ID, issued-at time (iat), and expiration (exp). The signature protects the data from tampering: a server verifies it with a secret or public key.
JWTs are commonly used for sessions and passing permissions between services. Remember: the token content is not encrypted, so don't put passwords or sensitive data inside. In ToolsHelper you can inspect header and payload without sending the token to us.
A claim is a named field in the payload, such as sub for the subject and exp for the expiry in seconds. The header names the algorithm. The signature covers both, so editing the payload without the key makes the signature fail on a real verifier. This page defines the parts. Decoding a token you already have is the converter, and it still does not check the signature.
FAQ
Is JWT encryption?
Usually no: JWS signs; payload is readable after decode.
Why is the token called a session?
A server can trust the claims without storing state, as long as the signature is valid and the token is not expired.