JWT Explained: Structure, Claims and Safe Use
A JSON Web Token is a compact, signed statement about an identity. It is easy to read, easy to verify, and easy to misuse. This guide walks through what is actually inside a token and the rules that keep it safe.
Three segments, two dots
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 <- header
.eyJzdWIiOiIxMjM0IiwiZXhwIjoxNzY1MDAwMDAwfQ <- payload
.dQw4w9WgXcQ_signature_bytes_here <- signatureThe header and payload are Base64URL-encoded JSON — readable by anyone who has the token. The signature is computed over the first two segments with a secret or private key, and it is what makes the token trustworthy.
A JWT payload is encoded, not encrypted. Never put passwords, card numbers or anything confidential inside one.
The header
{
"alg": "RS256",
"typ": "JWT",
"kid": "2026-key-01"
}alg names the signing algorithm and kid identifies which key was used, so a server can rotate keys without breaking existing tokens.
Registered claims worth knowing
| Claim | Meaning | Why it matters |
|---|---|---|
| iss | Issuer | Reject tokens minted by anyone else |
| sub | Subject — usually the user id | The identity the token asserts |
| aud | Audience | Stops a token for service A being replayed at service B |
| exp | Expiry timestamp | Must be checked on every request |
| nbf | Not before | Token is invalid until this time |
| iat | Issued at | Enables age-based policies |
| jti | Token id | Supports revocation lists and replay detection |
HS256 vs RS256
- HS256 is symmetric: the same secret signs and verifies. Simple, but every verifier can also mint tokens.
- RS256 (and ES256) are asymmetric: a private key signs, and a public key verifies. Verifiers cannot forge tokens, which is why identity providers use it.
- Choose asymmetric signing whenever more than one service verifies the token.
How verification should work
Verify a JWT correctly
- 1
Pin the algorithm
Decide server-side which algorithms are acceptable. Never trust the alg value in the header.
- 2
Resolve the key
Use kid to select the key from your JWKS endpoint or key store.
- 3
Check the signature
Recompute it over header.payload and compare using a constant-time function.
- 4
Validate the claims
Check exp, nbf, iss and aud against your expectations, with a small clock-skew allowance.
- 5
Apply authorisation
Only after all of the above, read roles or scopes from the payload.
JWT Decoder
Inspect the header, payload and expiry of a token locally — it is never transmitted.
Common mistakes
Accepting alg: none
The classic JWT vulnerability. A token with no signature must always be rejected.
Trusting the header's algorithm
An attacker can switch RS256 to HS256 and sign with your public key. Pin the expected algorithm server-side.
Decoding without verifying
Reading the payload is not authentication. Verify the signature before believing anything in it.
Very long expiry times
A JWT cannot be un-issued. Keep access tokens short-lived and use refresh tokens for longevity.
Storing tokens in localStorage
Any XSS can read them. Prefer httpOnly, Secure, SameSite cookies where the architecture allows.
Revocation, the hard part
Stateless verification is JWT's biggest advantage and its biggest limitation: a valid signature is accepted until it expires. Practical mitigations are short access-token lifetimes, a jti deny-list for emergencies, and a token version claim that is bumped when a user logs out everywhere.
Frequently asked questions
Can anyone read a JWT payload?
Yes. It is Base64URL-encoded JSON, not encrypted. Treat everything in it as public.
What makes a JWT secure then?
The signature. It proves the token was issued by a holder of the key and has not been modified.
How long should a JWT be valid?
Access tokens are typically 5–15 minutes, paired with a longer-lived refresh token that can be revoked server-side.
Is it safe to decode a JWT in an online tool?
Only if decoding happens in your browser. TheToolSera JWT Decoder parses locally and never sends the token anywhere.
Put this into practice
JWT Decoder runs entirely in your browser — no upload, no account, no limits.
Open JWT DecoderRelated tools
Related guides
Base64 Explained: What It Is and When to Use It
How Base64 turns binary into text, why output is about 33% larger, where padding comes from, URL-safe variants, and why Base64 is encoding rather than encryption.
Why Client-Side Tools Are Safer for Your Files
What actually happens when you upload a file to an online converter, how browser-based processing differs, how to verify a tool's claims, and when a server is unavoidable.
What Is JSON? A Plain-English Guide
JSON explained without jargon: what it is, how the syntax works, which data types it supports, where it is used and how it differs from JavaScript objects.
URL Encoding Explained (Percent-Encoding)
Why URLs need encoding, which characters are reserved, the difference between encodeURI and encodeURIComponent, plus and space confusion, and how to avoid double encoding.
JSON vs XML: Which Format Should You Use?
A practical JSON vs XML comparison: syntax, size, parsing speed, schemas, comments, attributes and metadata — plus clear guidance on which format fits which job.
Common JSON Errors and How to Fix Them
Decode the JSON parse errors you actually hit: unexpected token, trailing comma, unterminated string, BOM issues and duplicate keys — with the fix for each.