Learn How JWT Tokens Work
Decode example JWTs to understand the structure: header, payload, and signature. See real-world claim examples.
🔒 The token is decoded entirely in your browser. Nothing is sent to any server.
Learning JWT tips
Click "Load example" to see a sample JWT. Notice how it has three parts separated by dots: header, payload, and signature — each Base64URL-encoded.
The header and payload are *encoded*, not *encrypted*. Anyone with the token can read them. The signature is what proves the token wasn't tampered with.
The signature requires the secret/key to verify — that's how the server knows the token is genuine. Without the key, the signature is just a string of bytes.
The standard claims (iss, sub, aud, exp, nbf, iat, jti) are defined in RFC 7519. They're the universal JWT vocabulary used across providers.
Kif Taħdem
Għaliex nużaw tagħna?
Also check out…
Debug Authentication Issues with JWT Decoder
Inspect JWTs from your app to debug login failures
Inspect API Tokens While Testing Endpoints
Decode JWTs returned by your API to verify the rig
Security Audit JWT Tokens
Review JWTs as part of a security audit — check fo
Inspect OAuth and OpenID Connect Tokens
Decode access tokens, ID tokens, and refresh token