A JSON Web Token is a string in three parts separated by dots: header.payload.signature. It is commonly issued by an authentication server and sent as an access token on later API requests. The format is compact and URL-safe, which makes it easy to pass in headers.
What Is a JWT?
The Three Parts
- Header — usually
{ "alg": "HS256", "typ": "JWT" }, describing the signing algorithm and token type. - Payload — the claims, the data you want to inspect such as user ID and expiration.
- Signature — generated from the header, payload, and a secret or key, used by the issuer to detect tampering.
Common Claims
Registered claims include iss (issuer), sub (subject), aud (audience), exp (expiration), iat (issued at), nbf (not valid before), and jti (JWT ID). A JWT decoder shows these in a readable table so you can understand a token at a glance.
How Expiration Works
The exp, iat, and nbf claims are Unix timestamps in seconds. A decoder can convert exp into a human date and tell you whether the token has expired. That is a convenience check only — an unexpired token can still be invalid for other reasons.
Encoding vs Encryption
JWT segments are Base64URL-encoded, not encrypted. Anyone holding the token can decode and read the payload, so sensitive data should never be stored in a JWT. Decoding also differs from verification: reading the contents does not prove the signature is valid or that the issuer is trusted.