What is a JWT Token?
JSON Web Tokens (JWT) are the standard for authentication in modern web apps. A JWT has three Base64-encoded parts separated by dots:
header.payload.signature
Example:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
How to Decode a JWT
Using Our Free Tool
What's Inside a JWT
Header:
{
"alg": "HS256",
"typ": "JWT"
}
Payload (Claims):
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1516242622,
"role": "admin"
}
Common JWT Claims
|-------|-----------|-------------|
subiatexpissaudroleDebugging Common JWT Issues
Token Expired
Check the
exp claim — it's a Unix timestamp. Compare with current time.Invalid Signature
The signature uses the server's secret key. You can't verify it client-side, but you can check the algorithm in the header.
Wrong Claims
Decode the payload to verify the
sub, role, and other claims match expectations.