What is JWT?

A JWT (JSON Web Token) is a compact way to carry claims between parties. You will see JWTs in Authorization headers, browser storage, and service-to-service calls. A typical token has three Base64url-encoded parts separated by dots: header, payload, and signature.

What each part means

• Header — metadata such as the algorithm (alg) and token type.
• Payload — claims like subject (sub), expiry (exp), audience (aud), and custom fields.
• Signature — integrity check over the header and payload using a secret or key pair.

Decoding the first two parts only reveals JSON. It does not prove the token is authentic. Verification requires the correct key and claim checks in your real auth stack.

Common pitfalls

• Assuming “I can read it” means “it is valid.”
• Accepting alg: none or unexpected algorithms.
• Putting long-lived secrets inside JWT payloads.
• Pasting production tokens into shared or public tools.

Local inspection workflow

1. Copy a sample token you own (never a live production secret on a shared machine).
2. Inspect header and payload structure.
3. Confirm expiry and audience claims look right.
4. Verify signatures in your application code—not in a random website.

Practice on ToolHub

Open JWT Decoder to inspect structure locally. Use Base64 Encode/Decode when you need to understand the encoding layer, and Hash Generator when comparing digests in related security workflows. Prefer ToolHub’s privacy-first defaults: sensitive tools keep history off until you opt in.

Compare approaches

Auth design often chooses between tokens and server sessions. Read JWT vs Session Cookies for a structured comparison, and What is Base64? for the encoding underneath JWT segments.