The three parts of a JWT and what each one does. For the full explanation, see What Is a JWT?.
| Part | Contains |
|---|---|
| Header | The signing algorithm and token type, Base64URL-encoded |
| Payload | The claims (data), such as user ID and expiration time, Base64URL-encoded |
| Signature | A cryptographic signature verifying the token hasn’t been altered |
The JWT Decoder decodes any JWT and shows its header and payload instantly.
JWT Decoder
No, by default a JWT is only encoded and signed, not encrypted. Anyone can decode and read the payload, so it shouldn’t contain sensitive data unless it’s also encrypted separately.
That the token hasn’t been tampered with since it was issued, not that the payload’s contents are confidential.
Find the right tool, or browse Brekzy's other resources.