The Architectural Specification of RFC 7519 JSON Web Tokens
A JSON Web Token (JWT) is an open, industry-standard method (defined in RFC 7519) for representing claims securely between two parties in modern distributed web architectures and RESTful microservices. Unlike legacy session-cookie systems where a central database must be queried on every single API request, JWTs are compact, URL-safe, and completely stateless.
A serialized JWT consists of three distinct parts separated by period delimiters (.): the Header, the Payload, and the Signature:
| Token Segment | Standard Encoding | Primary Engineering Function |
|---|---|---|
| Header | Base64URL | Specifies the cryptographic signing algorithm (e.g., HS256, RS256) and token type. |
| Payload (Claims) | Base64URL | Contains authorization statements (claims) regarding the subject, roles, and expiration time. |
| Signature | Cryptographic Hash | Verifies that the sender of the JWT is who it says it is and ensures the message wasn't altered. |
Standard Registered Claims in Modern Payload Payloads
While developers can define private custom claims (such as user email or organizational role), the RFC specification reserves standardized claim keys to govern access control behavior:
iss(Issuer): Identifies the authorization server issuing the security assertion.sub(Subject): The unique identifier for the authenticated user or application.exp(Expiration Time): A Unix epoch timestamp identifying when the token stops being valid.iat(Issued At): The exact Unix timestamp recording when the assertion was constructed.
Security Rules: Encoding vs. Encryption
A common vulnerability in junior software engineering is assuming that JWT tokens are encrypted. Base64URL encoding is NOT encryption; it is simply a binary-to-text representation designed for URL and HTTP header transmission. Anyone possessing a public JWT can decode its contents in seconds. Consequently, you must never store sensitive data such as plain-text passwords, credit card numbers, or cryptographic private keys within the JWT payload.
Frequently Asked Questions (FAQs)
Is it safe to paste my production token into this decoder?
Yes. This tool functions 100% locally inside your browser client using native JavaScript string and Base64 operations. Zero bytes of your token, header, or claims are transmitted to our servers or saved in any logs.
Why does my signature show as unverified?
Validating an asymmetric or symmetric signature requires the server's private secret key. A public browser utility should never ask for your private secret key. This decoder inspects and formats claims without requiring you to expose your server credentials.
What does Base64URL mean compared to standard Base64?
Base64URL replaces characters like + with -, replaces / with _, and removes trailing = padding characters so the string can be safely passed inside HTTP headers and query strings without URL-encoding issues.