A JSON Web Token (JWT) is a compact way to carry claims. Decoding a token lets you read some of its content; it does not prove who issued it or that the contents are trustworthy. Never make an authorization decision from a decoded payload alone.
Recognize the token form
A signed JWT using the JWS compact form usually has three Base64url-encoded parts separated by periods: header, payload, and signature. The header identifies a signing algorithm and may include a key identifier. The payload contains claims such as issuer (iss), audience (aud), and expiration (exp). The signature is checked against the header and payload.
A JWT can also use the JWE encrypted form, which has five compact parts. Its contents are not readable without the appropriate decryption key. Therefore, “JWTs always have three parts” is not a safe assumption.
Decode for inspection only
Use the Toolsnix JWT Decoder with a test token or a token you are authorized to inspect. A decoder can display the header and claims; it does not validate the signature, issuer, audience, expiration, or application-specific permissions. Treat the displayed claims as untrusted input until verification succeeds.
Avoid pasting production tokens into tools or chats unless you understand the data handling. A bearer token can grant access while it remains valid. If it was exposed, follow the issuer’s revocation or rotation process.
What a verifier must check
Use a maintained JWT library configured for the expected algorithms. The verifier should reject algorithms the application does not permit, use the correct trusted key, and check the claims required by the application. That commonly includes issuer, audience, expiration, and not-before time. A valid signature only proves that the token was signed with a matching key; it does not automatically make every claim appropriate for every service.
Do not choose a key or algorithm solely because the untrusted token header requests it. Follow the library and identity provider’s verification guidance, and test invalid signatures, expired tokens, wrong audiences, and wrong issuers.
FAQ
Does successful decoding mean a token is valid?
No. It means the encoded content could be parsed. Verification and policy checks are separate steps.
Is the JWT payload encrypted?
Not in the usual signed JWS form. Its Base64url representation is encoding, not confidentiality. JWE is a separate encrypted form.
Can I change a claim and keep the token valid?
Changing signed content invalidates the signature. A system that does not verify the signature must not trust the token’s claims.