Interactive guide
Anatomy of a JWT token
A JSON Web Token has three parts separated by dots. Click each part below to see what it contains and how it decodes. The header and payload are Base64url-encoded JSON — not encrypted.
Interactive token explorer
Sample JWT
Decoded Header
{
"alg": "HS256",
"typ": "JWT"
}alg Algorithm
The signing algorithm used (HS256 = HMAC-SHA256)
typ Type
Token type — always "JWT"
How the three parts connect
The header tells the recipient which algorithm was used to create the signature. The payload carries the claims — the actual data the token transmits. The signature is computed over both the header and payload, binding them together cryptographically.
If an attacker modifies a single character in the header or payload, the signature no longer matches. The recipient recalculates the signature using their copy of the key and compares it to the signature in the token. A mismatch means the token was tampered with.
This is why JWTs are signed but not encrypted. Anyone can read the contents (Base64url decoding is trivial), but only someone with the signing key can create a valid signature. Never put secrets in JWT claims — they are readable by anyone who has the token.
Frequently asked questions
What is a JWT token?
A JWT (JSON Web Token) is a compact, URL-safe token for securely transmitting claims between two parties. It consists of three Base64url-encoded parts separated by dots: a header, a payload, and a signature.
Can I read a JWT without the secret key?
Yes. The header and payload are Base64url-encoded, not encrypted. Anyone can decode and read them. The signature verifies integrity but does not provide confidentiality.
What is Base64url encoding?
Base64url is a variant of Base64 that uses - instead of + and _ instead of /, making it safe for URLs and filenames. JWT uses Base64url without padding (no = characters).
How does the JWT signature work?
The signature is computed over the Base64url-encoded header and payload, using the algorithm specified in the header (e.g., HMAC-SHA256 with a shared secret, or RSA-SHA256 with a private key). The recipient verifies the signature to ensure the token has not been tampered with.
Decode your own tokens
Paste any JWT to inspect its header, payload, claims, and expiration status — all locally in your browser.
Open JWT Inspector