The Complete Guide to JWT Decoding: Structure, Claims & Client-Side Security

Overview

A JSON Web Token (JWT, pronounced "jot") is an open, industry-standard RFC 7519 method for securely representing claims between two parties. JWTs are widely used in modern web applications for user authentication, Single Sign-On (SSO), and API authorization.

Our JWT Decoder parses and formats JSON Web Tokens locally in your browser. Unlike third-party online debuggers that post your authorization tokens over the web, our tool never transmits or logs your credentials.

---

The Three Parts of a JWT

A standard JWT is composed of three parts separated by periods (.):

<Header>.<Payload>.<Signature>

1. Header

The header contains metadata regarding the token type and the cryptographic signing algorithm being used (such as HS256 HMAC SHA-256 or RS256 RSA Signature):

{
  "alg": "HS256",
  "typ": "JWT"
}

2. Payload (Claims)

The payload contains the actual claims—statements about an entity (typically the authenticated user) and additional metadata:

{
  "sub": "user_12345",
  "name": "Alex Smith",
  "role": "admin",
  "iat": 1700000000,
  "exp": 1700003600
}

3. Signature

The signature is created by hashing the Base64Url-encoded header and payload with a secret key or private key. It verifies that the token sender is authentic and that the payload has not been modified.

---

Standard Registered Claims

iss (Issuer): The identity provider or authority that issued the token.

sub (Subject): The principal identity (usually user ID).

aud (Audience): The intended recipient service for the token.

exp (Expiration Time): Unix epoch timestamp after which the token is invalid.

nbf (Not Before): The time before which the token must not be accepted.

iat (Issued At): Timestamp when the token was generated.

---

Important Security Warning: Decoding vs. Verifying

A JWT is encoded, not encrypted (unless using JWE). Anyone with access to a JWT can easily decode its Base64Url parts to read the payload.

Never store sensitive data like plaintext passwords, API keys, or credit card numbers in a JWT payload.

In production backends, always cryptographically verify the signature before trusting claims.