AG
JWT
DECODER
Decoder
Algorithms
Claims
Guides
About
한국어
English
日本語
中文
Español
Português
Français
Deutsch
Русский
العربية
Bahasa Indonesia
Decoder
/
Guides
/
The three-part JWT structure
Guide
The three-part JWT structure
Every JWT consists of header.payload.signature, and each part is base64url encoded.
Header: holds metadata such as the signing algorithm (alg) and token type (typ).
Payload: the body carrying the claims (iss, sub, exp, ...). Anyone can decode it, so put no secrets in it.
Signature: the header and payload signed with an algorithm and key, used to verify tampering.
Base64url-encode the three parts and join them with dots to form the complete JWT.
Try decoding a token yourself
Just paste and the header, payload and claims unfold instantly.
Open the decoder
Related
What is a JWT
A JWT (JSON Web Token) is a small, signed JSON token format for securely passing information between parties.
JWT security checklist
A short checklist of the key principles for using JWT safely.
JWT vs session authentication
The difference between token (JWT) auth and server session (cookie) auth, and when to use each.
Common JWT errors and fixes
The errors you meet most often when working with JWT, with their causes and fixes.
Access tokens and refresh tokens
The role of the short-lived access token and the refresh token that renews it.