Ctrl K

JWT Explained: Structure, Claims and Safe Use

intermediate TheToolSera Team 8 min read Updated 28 May 2026

A JSON Web Token is a compact, signed statement about an identity. It is easy to read, easy to verify, and easy to misuse. This guide walks through what is actually inside a token and the rules that keep it safe.

Three segments, two dots

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9   <- header
.eyJzdWIiOiIxMjM0IiwiZXhwIjoxNzY1MDAwMDAwfQ <- payload
.dQw4w9WgXcQ_signature_bytes_here          <- signature

The header and payload are Base64URL-encoded JSON — readable by anyone who has the token. The signature is computed over the first two segments with a secret or private key, and it is what makes the token trustworthy.

A JWT payload is encoded, not encrypted. Never put passwords, card numbers or anything confidential inside one.

The header

{
  "alg": "RS256",
  "typ": "JWT",
  "kid": "2026-key-01"
}

alg names the signing algorithm and kid identifies which key was used, so a server can rotate keys without breaking existing tokens.

Registered claims worth knowing

ClaimMeaningWhy it matters
issIssuerReject tokens minted by anyone else
subSubject — usually the user idThe identity the token asserts
audAudienceStops a token for service A being replayed at service B
expExpiry timestampMust be checked on every request
nbfNot beforeToken is invalid until this time
iatIssued atEnables age-based policies
jtiToken idSupports revocation lists and replay detection

HS256 vs RS256

  • HS256 is symmetric: the same secret signs and verifies. Simple, but every verifier can also mint tokens.
  • RS256 (and ES256) are asymmetric: a private key signs, and a public key verifies. Verifiers cannot forge tokens, which is why identity providers use it.
  • Choose asymmetric signing whenever more than one service verifies the token.

How verification should work

Verify a JWT correctly

  1. 1

    Pin the algorithm

    Decide server-side which algorithms are acceptable. Never trust the alg value in the header.

  2. 2

    Resolve the key

    Use kid to select the key from your JWKS endpoint or key store.

  3. 3

    Check the signature

    Recompute it over header.payload and compare using a constant-time function.

  4. 4

    Validate the claims

    Check exp, nbf, iss and aud against your expectations, with a small clock-skew allowance.

  5. 5

    Apply authorisation

    Only after all of the above, read roles or scopes from the payload.

JWT Decoder

Inspect the header, payload and expiry of a token locally — it is never transmitted.

Try JWT Decoder

Common mistakes

Accepting alg: none

The classic JWT vulnerability. A token with no signature must always be rejected.

Trusting the header's algorithm

An attacker can switch RS256 to HS256 and sign with your public key. Pin the expected algorithm server-side.

Decoding without verifying

Reading the payload is not authentication. Verify the signature before believing anything in it.

Very long expiry times

A JWT cannot be un-issued. Keep access tokens short-lived and use refresh tokens for longevity.

Storing tokens in localStorage

Any XSS can read them. Prefer httpOnly, Secure, SameSite cookies where the architecture allows.

Revocation, the hard part

Stateless verification is JWT's biggest advantage and its biggest limitation: a valid signature is accepted until it expires. Practical mitigations are short access-token lifetimes, a jti deny-list for emergencies, and a token version claim that is bumped when a user logs out everywhere.

Frequently asked questions

Can anyone read a JWT payload?

Yes. It is Base64URL-encoded JSON, not encrypted. Treat everything in it as public.

What makes a JWT secure then?

The signature. It proves the token was issued by a holder of the key and has not been modified.

How long should a JWT be valid?

Access tokens are typically 5–15 minutes, paired with a longer-lived refresh token that can be revoked server-side.

Is it safe to decode a JWT in an online tool?

Only if decoding happens in your browser. TheToolSera JWT Decoder parses locally and never sends the token anywhere.

Put this into practice

JWT Decoder runs entirely in your browser — no upload, no account, no limits.

Open JWT Decoder

Related tools

Related guides

All guides

Explore related topics