Quick answer
A JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and information exchange. It contains three parts - header, payload, and signature - separated by dots. To decode a JWT online, paste it into AiLoveKit's JWT Decoder and the tool splits the token into readable JSON, showing claims, expiration time, issuer, and audience. Important: decoding reveals the token's contents but does not verify its signature or trustworthiness. Processing runs entirely in your browser; your token is never transmitted.
What is a JWT, in plain language
When you log into a modern web application, the server often hands you a small signed document instead of creating a session in a database. That document is a JWT - a JSON Web Token. You store it (usually in a cookie or local storage) and present it with every request. The server reads it, verifies the signature, and knows who you are without looking you up in a database.
JWTs are popular because they are:
- Compact - a few hundred bytes, easy to transmit in headers and URLs.
- Self-contained - the token carries the user's identity and permissions.
- Standardized - RFC 7519, supported by virtually every programming language.
They are also frequently misunderstood. Because JWTs look like opaque strings, developers treat them as secrets. They are not - the payload is Base64-encoded, not encrypted, and trivially readable by anyone who sees the token. The security comes from the signature, not the encoding.
JWT structure: header, payload, signature
A JWT looks like this:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTUxNjIzOTAyMn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cIt has three segments separated by dots:
Header (red). Base64-encoded JSON declaring the algorithm (alg) and token type (typ). Example: {"alg":"HS256","typ":"JWT"}.
Payload (purple). Base64-encoded JSON containing claims - statements about the user and token metadata. Common claims:
sub(subject) - user ID.iat(issued at) - timestamp of creation.exp(expiration time) - when the token becomes invalid.iss(issuer) - who created the token.aud(audience) - intended recipient.- Custom claims - roles, permissions, tenant IDs.
Signature (blue). A cryptographic hash of the header + payload + a secret key. The signature proves the token was issued by someone who holds the secret and hasn't been tampered with since.
How to decode a JWT token: step by step
Step 1: Open the JWT Decoder. Browser-based, no account, no upload.
Step 2: Paste the token. Copy the full token string - including all three segments and the dots.
Step 3: Decode. The tool Base64-decodes the header and payload into readable JSON and displays them with syntax highlighting.
Step 4: Inspect JWT claims. Read the payload fields: user ID, role, expiration, issuer. Check the header for the signing algorithm.
Step 5: Check JWT expiration time. The exp claim is a Unix timestamp. The decoder converts it to human-readable date/time so you know if the token is still valid.
Step 6: Copy decoded sections. Export the header or payload JSON for debugging, documentation, or comparison.
Understanding JWT claims and expiration
JWT claims are the data layer. Understanding them is critical for debugging authentication issues:
exp(expiration): Tokens are short-lived by design - minutes to hours. A token past itsexpis rejected. If users report sudden logouts, check whetherexpis too aggressive.iat(issued at): Useful for freshness checks and detecting clock-skew issues.nbf(not before): The token is invalid before this time. Rarely used outside scheduled-access scenarios.sub(subject): The primary user identifier. This is what your application maps to a user record.scopeor custom role claims: Authorization data. The token carries what the user can do, not just who they are.
JWT authentication explained
In a typical flow:
- User submits credentials (username/password).
- Server validates them and issues a JWT signed with a secret key.
- Client stores the JWT and sends it in the
Authorization: Bearer <token>header on subsequent requests. - Server decodes the JWT, verifies the signature against its secret, checks
exp, and trusts the claims.
Because the server doesn't store session state, JWT authentication scales horizontally: any server in a cluster can verify the token independently. The tradeoff is revocation: once issued, a JWT is valid until it expires. Logging out requires either short expiration + refresh tokens, or a server-side denylist - both add complexity.
JWT security risks and safe handling
Decoding is not signature verification. The decoder shows you what's inside the token; it does not prove the token is legitimate. A forged token with a fake signature decodes just as cleanly as a real one. Signature verification requires the secret key - which must never be pasted into any third-party website.
Never paste production secrets or sensitive tokens into third-party websites. Even "just a decoder" on a server-based site receives your token. If that token is still valid and carries admin privileges, you've handed an attacker a credential.
AiLoveKit's JWT Decoder runs entirely client-side - the token never leaves your browser - but the general rule stands: treat tokens as credentials, not as inert text. Decode in a private browser session if the token is sensitive, and revoke or rotate tokens after debugging.
Other risks:
- Weak secrets: HS256 with a short, guessable secret is breakable.
- Algorithm confusion: An attacker changes
algtononeor a weak algorithm. Always verify the algorithm matches what your backend expects. - Token leakage: XSS attacks can steal tokens from browser storage. Use
HttpOnlycookies where possible, or short-lived tokens in memory.
Frequently asked questions
What is a JWT token in simple terms?
A signed digital document that proves who you are to a website, containing your identity and permissions in a compact, readable format.
Can I decode a JWT online?
Yes - paste it into the JWT Decoder to read header and payload JSON instantly.
Does decoding verify the token is real?
No. Decoding is not signature verification. Anyone can forge a token; only signature verification with the secret key proves legitimacy.
Is it safe to paste JWTs into online decoders?
With client-side tools like AiLoveKit's, the token isn't transmitted. Still, avoid pasting live production tokens anywhere.
What does exp mean in a JWT?
Expiration time - a Unix timestamp after which the token must be rejected. It's the primary mechanism for token lifecycle.
Can a JWT be encrypted?
JWTs are encoded (Base64), not encrypted, by default. JWE (JSON Web Encryption) is the encrypted variant but is rarely used in standard web auth.
What algorithm should a JWT use?
RS256 (RSA signature) or ES256 (ECDSA) for asymmetric verification in distributed systems; HS256 (HMAC) is fine for internal services with strong secrets.