A JSON Web Token (JWT) is a compact string used to pass identity and permission information between a client and a server. You will often see one in login systems and API requests.
The three parts of a JWT
A JWT looks like three chunks separated by dots:
xxxxx.yyyyy.zzzzz
- Header: says which algorithm is used, for example
HS256orRS256. - Payload: contains claims, such as the user ID, roles, and expiry time.
- Signature: proves the token was not altered, and was created by someone with the right key.
The header and payload are Base64URL-encoded JSON, not encrypted. That means anyone who has the token can read them.
Common payload claims
sub: the subject, usually a user IDiss: who issued the tokenexp: expiry time (a Unix timestamp)iat: when it was issuedaud: the intended audience
Decoding is not verifying
This is the most important point. Decoding simply reveals what is written in the token. It does not confirm the token is genuine. Only your server, using the correct secret or public key, can verify the signature. Never trust the contents of a token just because it decodes neatly.
How to decode a JWT
- Copy the token from your request header or app storage.
- Paste it into a JWT decoder to view the header and payload.
- Check the
expvalue to see whether it has expired. A time duration calculator can help when comparing timestamps.
Staying safe
- Do not paste live production tokens into tools you do not trust, since a valid token can act as a login. Use expired, test, or development tokens where possible.
- Never put passwords or secrets inside a JWT payload, because it is readable by anyone.
- Keep expiry times short and refresh tokens carefully.
- Always verify signatures on the server side.
Debugging checklist
- Is the token expired (
exp)? - Is the
audorisswhat your server expects? - Is the algorithm in the header the one your server accepts?
- Is the token being sent in the correct header, usually
Authorization: Bearer <token>?
