# What Is a JWT Token? How to Decode, Inspect and Understand JSON Web Tokens > A JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and information exchange. - **Published:** 2026-11-05 - **Category:** Dev Tools - **Canonical:** https://blog.ailovekit.com/what-is-jwt-token-decode/ ### Quick answer A JWT (JSON Web Token) is a compact, URL-safe token format used for authentication and information exchange. It contains three parts - header, payload, and signature - separated by dots. To decode a JWT online, paste it into AiLoveKit's **JWT Decoder** and the tool splits the token into readable JSON, showing claims, expiration time, issuer, and audience. **Important:** decoding reveals the token's contents but does not verify its signature or trustworthiness. Processing runs entirely in your browser; your token is never transmitted. ## Table of contents - [What is a JWT, in plain language](#what-is-a-jwt-in-plain-language) - [JWT structure: header, payload, signature](#jwt-structure-header-payload-signature) - [How to decode a JWT token: step by step](#how-to-decode-a-jwt-token-step-by-step) - [Understanding JWT claims and expiration](#understanding-jwt-claims-and-expiration) - [JWT authentication explained](#jwt-authentication-explained) - [JWT security risks and safe handling](#jwt-security-risks-and-safe-handling) - [FAQs](#faqs) ## What is a JWT, in plain language When you log into a modern web application, the server often hands you a small signed document instead of creating a session in a database. That document is a JWT - a JSON Web Token. You store it (usually in a cookie or local storage) and present it with every request. The server reads it, verifies the signature, and knows who you are without looking you up in a database. JWTs are popular because they are: - **Compact** - a few hundred bytes, easy to transmit in headers and URLs. - **Self-contained** - the token carries the user's identity and permissions. - **Standardized** - RFC 7519, supported by virtually every programming language. They are also frequently misunderstood. Because JWTs look like opaque strings, developers treat them as secrets. They are not - the payload is Base64-encoded, not encrypted, and trivially readable by anyone who sees the token. The security comes from the signature, not the encoding. ## JWT structure: header, payload, signature A JWT looks like this: `eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFkYSIsImlhdCI6MTUxNjIzOTAyMn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c` It has three segments separated by dots: **Header (red).** Base64-encoded JSON declaring the algorithm (`alg`) and token type (`typ`). Example: `{"alg":"HS256","typ":"JWT"}`. **Payload (purple).** Base64-encoded JSON containing claims - statements about the user and token metadata. Common claims: - `sub` (subject) - user ID. - `iat` (issued at) - timestamp of creation. - `exp` (expiration time) - when the token becomes invalid. - `iss` (issuer) - who created the token. - `aud` (audience) - intended recipient. - Custom claims - roles, permissions, tenant IDs. **Signature (blue).** A cryptographic hash of the header + payload + a secret key. The signature proves the token was issued by someone who holds the secret and hasn't been tampered with since. ## How to decode a JWT token: step by step **Step 1: Open the JWT Decoder.** Browser-based, no account, no upload. **Step 2: Paste the token.** Copy the full token string - including all three segments and the dots. **Step 3: Decode.** The tool Base64-decodes the header and payload into readable JSON and displays them with syntax highlighting. **Step 4: Inspect JWT claims.** Read the payload fields: user ID, role, expiration, issuer. Check the header for the signing algorithm. **Step 5: Check JWT expiration time.** The `exp` claim is a Unix timestamp. The decoder converts it to human-readable date/time so you know if the token is still valid. **Step 6: Copy decoded sections.** Export the header or payload JSON for debugging, documentation, or comparison. ## Understanding JWT claims and expiration JWT claims are the data layer. Understanding them is critical for debugging authentication issues: - **exp (expiration):** Tokens are short-lived by design - minutes to hours. A token past its `exp` is rejected. If users report sudden logouts, check whether `exp` is too aggressive. - **iat (issued at):** Useful for freshness checks and detecting clock-skew issues. - **nbf (not before):** The token is invalid before this time. Rarely used outside scheduled-access scenarios. - **sub (subject):** The primary user identifier. This is what your application maps to a user record. - **scope or custom role claims:** Authorization data. The token carries *what the user can do*, not just *who they are*. ## JWT authentication explained In a typical flow: - User submits credentials (username/password). - Server validates them and issues a JWT signed with a secret key. - Client stores the JWT and sends it in the `Authorization: Bearer ` header on subsequent requests. - Server decodes the JWT, verifies the signature against its secret, checks `exp`, and trusts the claims. Because the server doesn't store session state, JWT authentication scales horizontally: any server in a cluster can verify the token independently. The tradeoff is revocation: once issued, a JWT is valid until it expires. Logging out requires either short expiration + refresh tokens, or a server-side denylist - both add complexity. ## JWT security risks and safe handling **Decoding is not signature verification.** The decoder shows you what's inside the token; it does not prove the token is legitimate. A forged token with a fake signature decodes just as cleanly as a real one. Signature verification requires the secret key - which must never be pasted into any third-party website. **Never paste production secrets or sensitive tokens into third-party websites.** Even "just a decoder" on a server-based site receives your token. If that token is still valid and carries admin privileges, you've handed an attacker a credential. AiLoveKit's JWT Decoder runs entirely client-side - the token never leaves your browser - but the general rule stands: treat tokens as credentials, not as inert text. Decode in a private browser session if the token is sensitive, and revoke or rotate tokens after debugging. Other risks: - **Weak secrets:** HS256 with a short, guessable secret is breakable. - **Algorithm confusion:** An attacker changes `alg` to `none` or a weak algorithm. Always verify the algorithm matches what your backend expects. - **Token leakage:** XSS attacks can steal tokens from browser storage. Use `HttpOnly` cookies where possible, or short-lived tokens in memory. **Try it now:** [JWT Decoder - inspect tokens safely in your browser →](https://www.ailovekit.com/dev/jwt-decoder/) ## Frequently asked questions ### What is a JWT token in simple terms? A signed digital document that proves who you are to a website, containing your identity and permissions in a compact, readable format. ### Can I decode a JWT online? Yes - paste it into the JWT Decoder to read header and payload JSON instantly. ### Does decoding verify the token is real? No. Decoding is not signature verification. Anyone can forge a token; only signature verification with the secret key proves legitimacy. ### Is it safe to paste JWTs into online decoders? With client-side tools like AiLoveKit's, the token isn't transmitted. Still, avoid pasting live production tokens anywhere. ### What does `exp` mean in a JWT? Expiration time - a Unix timestamp after which the token must be rejected. It's the primary mechanism for token lifecycle. ### Can a JWT be encrypted? JWTs are encoded (Base64), not encrypted, by default. JWE (JSON Web Encryption) is the encrypted variant but is rarely used in standard web auth. ### What algorithm should a JWT use? RS256 (RSA signature) or ES256 (ECDSA) for asymmetric verification in distributed systems; HS256 (HMAC) is fine for internal services with strong secrets. ## Frequently Asked Questions **What is a JWT token in simple terms?** A signed digital document that proves who you are to a website, containing your identity and permissions in a compact, readable format. **Can I decode a JWT online?** Yes - paste it into the JWT Decoder to read header and payload JSON instantly. **Does decoding verify the token is real?** No. Decoding is not signature verification. Anyone can forge a token; only signature verification with the secret key proves legitimacy. **Is it safe to paste JWTs into online decoders?** With client-side tools like AiLoveKit's, the token isn't transmitted. Still, avoid pasting live production tokens anywhere. **What does `exp` mean in a JWT?** Expiration time - a Unix timestamp after which the token must be rejected. It's the primary mechanism for token lifecycle. **Can a JWT be encrypted?** JWTs are encoded (Base64), not encrypted, by default. JWE (JSON Web Encryption) is the encrypted variant but is rarely used in standard web auth. **What algorithm should a JWT use?** RS256 (RSA signature) or ES256 (ECDSA) for asymmetric verification in distributed systems; HS256 (HMAC) is fine for internal services with strong secrets. --- Source: https://blog.ailovekit.com/what-is-jwt-token-decode/ AiLoveKit Blog: https://blog.ailovekit.com/ Machine-readable index: https://blog.ailovekit.com/llms.txt