What is a JSON Web Token (JWT)?
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.
- The 3 Parts of a JWT: A token consists of three parts separated by dots (`.`):
- Header: Contains metadata about the type of token and the cryptographic algorithms used to secure its contents.
- Payload (Claims): Contains the actual verifiable data entities (like User ID, roles, email, or expiration time).
- Signature: Used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way.
- Decoding vs. Verifying: Decoding a JWT is not the same as verifying it. Anyone can decode the Header and Payload because they are simply Base64Url encoded. To verify the token (to ensure it hasn't been tampered with), you need the secret key from the server.
- 100% Privacy Preserved: Because JWTs often contain sensitive user data or email addresses, our tool decodes the token entirely via JavaScript inside your browser. Your token is never uploaded to our servers.