What is a JWT?
A JSON Web Token (JWT, pronounced "jot") is a compact, URL-safe means of representing claims between two parties. It is widely used for authentication (proving who you are after login) and authorisation (proving what you are allowed to do). A JWT is a string of three base64url-encoded sections separated by dots: header.payload.signature.
The three parts of a JWT
The header (red section) is a JSON object containing the token type ("JWT") and the signing algorithm (HS256, RS256, ES256, etc.). The payload (purple section) contains the claims — JSON key-value pairs about the user and the token. The signature (green section) is a cryptographic signature that verifies the token has not been tampered with; it is computed from the header, payload, and a secret key that only the server knows.
Standard claims in the payload
The JWT specification defines several standard claim names: iss (issuer — who created the token), sub (subject — who the token is about, typically a user ID), aud (audience — who the token is intended for), exp (expiration time — Unix timestamp after which the token is invalid), nbf (not before — Unix timestamp before which the token is invalid), iat (issued at — when the token was created), jti (JWT ID — a unique identifier for this token). Applications also add custom claims like roles, permissions, and user details.
How the decoder works
The decoder splits the JWT on the dots, base64url-decodes the header and payload sections, and pretty-prints them as JSON with syntax highlighting. It parses any timestamp claims (exp, iat, nbf) and converts them from Unix timestamps to human-readable dates. It checks whether the token is currently valid (exp is in the future) or expired (exp is in the past). All of this happens entirely in your browser — your token never leaves your device.
What the decoder cannot do
The decoder cannot verify the signature — that requires the secret key, which only the server has. A decoded JWT may be structurally valid and display all claims correctly, but that does not mean the signature is valid. Never trust a JWT's claims without server-side signature verification. The decoder is a diagnostic tool for understanding what a token contains, not a security validation tool.
Security considerations when inspecting JWTs
JWT payloads are base64url-encoded, not encrypted. Anyone who has the token can decode and read all the claims without knowing the secret. Never put sensitive data in a JWT payload — assume it is publicly readable. If you need to transmit sensitive claims, use JWE (JSON Web Encryption) rather than standard JWT. Do not paste production JWTs with sensitive claims into online tools — use the ToolHive decoder, which is fully offline, or decode locally in your browser's console with atob(token.split('.')[1]).