What is a JSON Web Token (JWT)?
A JSON Web Token (RFC 7519) is a compact, URL-safe means of representing claims securely between two parties. JWTs are commonly employed in modern web applications for stateless user authentication, OAuth 2.0 bearer authorization tokens, and API identity exchanges.
Anatomy of a JWT
A standard JSON Web Token consists of three distinct parts separated by dots (.):
- Header: Specifies the cryptographic signing algorithm (such as HS256, RS256, or ES256) and token type.
- Payload: Contains claims—statements about the user (subject) and metadata (issuer, expiration timestamp, audience, and custom roles).
- Signature: A cryptographic signature generated by hashing the base64-encoded header and payload with a secret or private key.
Standard Registered Claims Explained
sub(Subject): The principal ID or unique user identifier.iss(Issuer): The identity provider or authority issuing the token.exp(Expiration Time): Unix epoch timestamp after which the token must not be accepted.iat(Issued At): Timestamp denoting when the token was created.nbf(Not Before): The timestamp before which the token must not be processed.
Decoding vs. Verifying
This browser tool decodes Base64Url-encoded headers and payloads so developers can debug token contents quickly. However, decoding is not verification. In a production backend, you must always verify the token's cryptographic signature against your public key or shared secret before trusting any claims inside the payload.