JWT anatomy: what lives inside a token
JWTs are short strings with three dots. Learn what each segment holds and why signing matters.
The three-part shape
A JSON Web Token (JWT) is three Base64URL-encoded segments joined by dots: header.payload.signature. The header declares the signing algorithm, the payload holds the claims (subject, expiry, custom fields), and the signature proves the token was issued by a trusted party.
Encoded, not encrypted
Anyone can decode the header and payload of a JWT — that is exactly what our JWT Decoder does. The signature is what stops attackers from tampering with the claims, because verifying it requires the server’s secret or public key.
Best-practice checklist
Always set a short expiry (exp). Prefer asymmetric algorithms (RS256, EdDSA) for public APIs. Rotate signing keys. Never accept a token with alg: none.
Inspect a token now
Paste any JWT into the JWT Decoder to see the header and payload side by side — processing happens locally, so even production tokens stay private.
Try it in Code Formatter Pro
Every tool mentioned in this article runs entirely inside your browser — no signup, no uploads.
Open the toolkit