# Inside a JWT: three parts, two dots, and why decoding is not the same as trusting

> A JSON Web Token looks like a random string with two dots. Split it at the dots and each part is readable. The catch: anyone can read it, and only the signature proves nobody changed it.

Published 2026-10-08 by Toolcloak. 3 minute read. Original: https://toolcloak.pages.dev/articles/inside-a-jwt-three-parts-one-dot-at-a-time
Related free tool: [JWT Decoder](https://toolcloak.pages.dev/tools/jwt-decoder)

Log in to many apps and the server hands you a token that looks like `xxxxx.yyyyy.zzzzz`. That is a JWT. It is the app's way of saying, without looking anything up, “this person was already checked.” Understanding what is inside makes login bugs much easier to fix.

> **In short**
> - A JWT has **three parts** joined by dots: header, payload, signature.
> - Header and payload are only **Base64URL-encoded JSON**. They are **not encrypted**, so anyone can read them.
> - The **signature** is what stops tampering. Decoding a token does not check it.
> - Never put passwords or secrets in the payload.

## The three parts

**header.payload.signature**

1. **Header.** Says which algorithm signed it, for example HS256 or RS256, and that the type is JWT
2. **Payload.** The claims: who the user is, who issued it, and when it expires
3. **Signature.** A fingerprint made with a secret or private key. Change one character in the first two parts and it stops matching

*The first two parts are Base64URL text. A browser or a decoder tool can read them in a blink.*

## The claims you will see

| Claim | Meaning | Example |
| --- | --- | --- |
| `sub` | Subject: who the token is about | A user ID |
| `iss` | Issuer: who created it | Your auth server's address |
| `aud` | Audience: who it is meant for | Your API |
| `exp` | Expiry time, as a Unix timestamp | 1790000000 |
| `iat` | Issued-at time | Unix timestamp |
| `nbf` | Not valid before this time | Unix timestamp |
| `jti` | A unique ID for this token | Random string |

*Times are Unix seconds. See [Unix time](https://toolcloak.pages.dev/articles/unix-time-the-number-that-counts-seconds-since-1970) for how to read them.*

Try it: [JWT Decoder](https://toolcloak.pages.dev/tools/jwt-decoder). Paste a token to see its header and payload, with the expiry turned into a readable date. Nothing leaves your browser.

## Decoding is not verifying

**Two very different actions**

| Box | What it means |
| --- | --- |
| Decode | Turn the first two parts back into JSON. Anyone can do it, no key needed. Fine for debugging. |
| Verify | Recompute the signature with the key and compare. This is what proves the token is genuine. |
| Trust the payload after decoding only | Dangerous. An attacker can write any payload they like. |
| Trust it after verifying and checking exp | Correct. Verify the signature, then the time and audience. |

*Your server must verify every token on every request. A decoder tool is for reading, not for trusting.*

## Why “it is just encoded” matters

**What a JWT is, and is not**

| Is | Is not |
| --- | --- |
| Signed | Secret |
| Tamper-evident | Anyone holding it can read it |
| Self-contained: the server needs no lookup | Not encrypted by default, so no passwords or private data inside |

*If you need the contents hidden, use an encrypted token (JWE) or keep the data on the server and send only an ID.*

## Common JWT mistakes

1. **Not checking `exp`.** Without it, a stolen token works forever.
2. **Accepting `alg: none`.** Always pin the allowed algorithms on the server.
3. **Long expiry for everything.** Keep access tokens short, refresh them with a separate token.
4. **Storing tokens where scripts can read them.** If a page can be injected, the token can be stolen.
5. **Pasting a live token into random websites.** Use a tool that decodes locally, and treat real tokens like passwords.

## Frequently asked questions

### What is a JWT?

A JSON Web Token: a signed string made of a header, a payload of claims and a signature, joined by dots. Servers use it to prove a user was already authenticated.

### Is a JWT encrypted?

Not by default. The header and payload are only Base64URL-encoded, so anyone can read them. The signature only prevents tampering.

### What is the difference between decoding and verifying a JWT?

Decoding just reads the contents and needs no key. Verifying recomputes the signature with the key to prove the token is genuine and unaltered.

### What does exp mean in a JWT?

The expiry time, as a Unix timestamp in seconds. After that moment the token must be rejected.

### Is it safe to paste a JWT into an online decoder?

Only if the tool decodes in your browser and you are not sending a live production token to a service you do not trust. Treat real tokens like passwords.