How to Decode JWT Tokens — Complete Developer Guide & Security Reference

JSON Web Tokens (JWT, pronounced "jot") are an open, industry-standard RFC 7519 method for securely transmitting claims between parties as a compact JSON object.

JWTs are ubiquitously used in modern web architecture for stateless authentication, single sign-on (SSO), and API access tokens.

1. Anatomy of a JSON Web Token

A standard JWT string consists of three distinct segments separated by periods (.):

┌───────────────────────────┬───────────────────────────┬───────────────────────────┐
│          HEADER           │          PAYLOAD          │         SIGNATURE         │
│  {"alg":"HS256","typ":    │  {"sub":"12345","name":   │  HMACSHA256(              │
│   "JWT"}                  │   "Saad","role":"admin"}  │   base64(header) + "." +  │
│                           │                           │   base64(payload), secret)│
└───────────────────────────┴───────────────────────────┴───────────────────────────┘

A. The Header

Specifies the cryptographic algorithm used to sign the token (e.g. HS256, RS256, ES256) and the token type (JWT).

B. The Payload (Claims)

Contains identity claims and timestamps (sub, iss, exp, iat).

C. The Signature

Generated by taking the encoded header, payload, and secret key to prevent tampering.