What Is a JWT (JSON Web Token)?
A JWT is a compact, self-contained token that encodes a JSON payload and a cryptographic signature as three dot-separated Base64url strings. It lets a server verify claims — like user identity and permissions — without storing session state.
The One-Line Definition
A JSON Web Token (JWT) is a URL-safe string of the form header.payload.signature where each section is Base64url-encoded. It is defined in RFC 7519.
JWT Structure
Every JWT consists of exactly three sections, separated by dots:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 .eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ .SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
{"alg":"HS256","typ":"JWT"}Base64url(header) + "." + Base64url(payload) with the algorithm declared in the header and a secret or private key.Standard JWT Claims (Registered Claims)
RFC 7519 defines seven registered claim names. All are optional but widely used:
| Claim | Type | Meaning |
|---|---|---|
| iss | string | Issuer — identifies who issued the token (e.g. your auth server URL) |
| sub | string | Subject — the principal the token represents (typically a user ID) |
| aud | string | string[] | Audience — the intended recipient(s); servers should reject tokens with the wrong aud |
| exp | number | Expiration time — Unix timestamp after which the token must be rejected |
| nbf | number | Not Before — Unix timestamp before which the token must be rejected |
| iat | number | Issued At — Unix timestamp when the token was created |
| jti | string | JWT ID — unique identifier for this token, used to prevent replay attacks |
Signing Algorithms
The Payload Is Not Secret
The header and payload are only Base64url-encoded — not encrypted. Anyone who holds the token can decode and read the payload without the signing secret. Never include passwords, credit card numbers, or other sensitive data in a JWT payload unless you use a JWE (JSON Web Encryption) token instead.
JWT vs Session-Based Authentication
Decode a JWT Now
Paste any JWT into SmartDevBox and the header and payload are decoded automatically — no tool selection, no secret required, no data sent to a server. Open the JWT Decoder → or JWT Encoder (sign tokens) →
Frequently Asked Questions
Can you decode a JWT without the secret?
Yes. The header and payload are Base64url-encoded, not encrypted. Anyone can decode and read them. The secret is only needed to verify that the token was issued by a trusted party.
What is the difference between JWT authentication and session-based authentication?
Session-based auth stores state on the server; JWTs are stateless — all claims are in the token. JWTs scale horizontally without shared storage but are harder to revoke before expiry.
What JWT signing algorithms should I use?
For new systems: ES256 (ECDSA P-256) or RS256 for asymmetric scenarios where verifiers should not be able to issue tokens. HS256 is fine for simple server-to-server use where the same party signs and verifies. Avoid the none algorithm — it disables signature verification.
How do I decode a JWT online for free?
Paste your JWT into SmartDevBox. It auto-detects the three-part JWT structure and shows the decoded header and payload as formatted JSON — no account, no secret needed, 100% client-side.