What is a JSON Web Token?
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
In modern web development, JWTs are most commonly used for authorization and authentication. When a user logs in, the authentication server issues a JWT token. The client then includes this token in subsequent API requests (typically in the Authorization header as a Bearer token), enabling stateless communication.
Structure of a JWT
A JWT consists of three parts separated by dots (.):
- Header: Typically consists of two parts: the type of the token (which is JWT) and the signing algorithm being used (such as HS256 or RS256).
- Payload: Contains the claims. Claims are statements about an entity (typically, the user) and additional metadata (such as expiration timestamp
expand issueriss). - Signature: Used to verify that the sender of the JWT is who it claims to be and to ensure that the message wasn't changed along the way. It is created by signing the encoded header, encoded payload, and a secret or key.
Time Claims and Token Validation
Our JWT Decoder automatically parses key time-based claims inside the payload:
- exp (Expiration Time): The timestamp after which the token must not be accepted for processing.
- iat (Issued At): The timestamp at which the token was created.
- nbf (Not Before): The timestamp before which the token must not be accepted.
The tool calculates relative times dynamically (e.g. "Expires in 10 minutes") to help developers debug token expiration windows or timezone discrepancies.
Because your token may contain sensitive payloads (user IDs, emails, roles, or authorization credentials), keeping decoding 100% client-side in the browser prevents security leaks.