What is a JWT (JSON Web Token)?
A JWT is a signed, Base64URL-encoded token with three parts: header, payload, signature. Learn how JWTs work and decode one free — no data leaves your browser.
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. You see them everywhere in auth: after you log in, an API hands you a JWT that you send back on each request to prove who you are.
The three parts
A JWT is three Base64URL strings joined by dots: header.payload.signature. The header says which algorithm signed it (e.g. HS256, RS256). The payload holds the claims — sub (subject), exp (expiry), iat (issued-at), and any custom fields. The signature is computed over the header and payload with a secret or private key.
Encoded, not encrypted
A common misconception: a standard JWT is signed, not encrypted. Anyone who holds the token can read the payload by Base64-decoding it — so never put passwords or secrets in a JWT. The signature only guarantees the token was not tampered with, not that its contents are hidden.
How the signature protects it
The server recomputes the signature from the header and payload using its key. If even one byte of the payload changed, the signatures will not match and the token is rejected. This is why you can trust a valid JWT without a database lookup.
Try it now — free, no signup
Use the JWT decoder in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.