What is a JWT used for?

A JWT (JSON Web Token) is commonly used for authentication — after you log in, the server issues a signed token your browser sends with each request to prove who you are without a fresh login.

No. A standard JWT is only encoded and signed, not encrypted. Anyone can decode and read its payload, so never put passwords or secrets in it. The signature only detects tampering.

What are the three parts of a JWT?

Header, payload and signature, separated by dots. The header names the algorithm, the payload holds claims like user ID and expiry, and the signature verifies the first two were not altered.

How do I check if a JWT is expired?

Decode it and read the exp claim, a Unix timestamp for when it stops being valid. Our JWT Decoder shows the expiry in a readable form so you can see at a glance whether it's still good.

Developer · 4 min read

What Is a JWT (JSON Web Token)?

Understand JSON Web Tokens: the header, payload, and signature, how JWTs are used for authentication, and why you should never trust an unverified token.

By the ToolsHub team · Updated May 1, 2026

A JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties. It's widely used for authentication: after you log in, a server issues a token your browser sends with each request to prove who you are.

The three parts

A JWT is three Base64URL-encoded sections separated by dots: header.payload.signature.

Header — the token type and signing algorithm (e.g. HS256).
Payload — the claims: user id, expiry (exp), issuer, etc.
Signature — a cryptographic signature that proves the token wasn't tampered with.

Important: decoding is not verifying

The header and payload are only encoded, not encrypted — anyone can read them. Security comes from the signature, which a server checks with a secret key. Never trust a token's contents without verifying its signature, and never put sensitive data in the payload.

JWT security best practices

Because a JWT's payload is readable by anyone, treat it as public data. A few habits keep JWT-based auth safe:

Never store passwords, card numbers or other secrets in the payload — it is only Base64-encoded, not encrypted.
Keep expiry (exp) short and issue refresh tokens for longer sessions.
Always verify the signature on the server before trusting a token, and reject the none algorithm.
Store tokens carefully in the browser; an HttpOnly cookie resists theft by scripts better than localStorage.

To inspect a token safely, our JWT Decoder runs entirely in your browser, so you can paste even a production token without it being sent anywhere.

Frequently asked questions

What is a JWT used for?: A JWT (JSON Web Token) is commonly used for authentication — after you log in, the server issues a signed token your browser sends with each request to prove who you are without a fresh login.
Is a JWT encrypted?: No. A standard JWT is only encoded and signed, not encrypted. Anyone can decode and read its payload, so never put passwords or secrets in it. The signature only detects tampering.
What are the three parts of a JWT?: Header, payload and signature, separated by dots. The header names the algorithm, the payload holds claims like user ID and expiry, and the signature verifies the first two were not altered.
How do I check if a JWT is expired?: Decode it and read the exp claim, a Unix timestamp for when it stops being valid. Our JWT Decoder shows the expiry in a readable form so you can see at a glance whether it's still good.

Try the tool

JWT Decoder →JWT Encoder / Generator →JWT Verifier →Base64 Encode/Decode →