DEVELOPER GUIDE
JWT Basics: Decode vs Verify
JSON Web Tokens are often used in authentication and authorization systems. Decoding a JWT is easy; proving that its claims are trustworthy requires signature verification and application-specific validation.
Understand the three parts
A compact JWT commonly contains a header, payload, and signature separated by periods.
Decoding is not verification
Anyone who has a JWT can decode its header and payload. Those readable claims should not automatically be trusted.
Verification is a separate operation
A receiving application should verify the signature using the expected algorithm and key, then validate claims such as issuer, audience, expiration, and not-before when applicable.
Use the decoder for troubleshooting
The JWT Decoder on this site is for inspection. It deliberately does not claim to verify signatures.