Understanding JSON Web Token Architecture (RFC 7519)
JSON Web Tokens (JWT) are an open industry standard for securely transferring information between parties as compact JSON objects. Used extensively in OAuth 2.0, OpenID Connect, and stateless REST API authentication, tokens are composed of three parts separated by periods (.): the Header, the Payload, and the Cryptographic Signature.
Decoding vs. Verifying
JWTs are encoded, not encrypted (unless using JWE). The header and payload are readable by anyone via Base64URL decoding. The signature proves authenticity, while decoding allows inspecting claims without knowing the private secret key.
Standard Registered Claims
JWT specifications reserve standardized claim keys: iss (Issuer), sub (Subject / User ID), aud (Audience), exp (Expiration), nbf (Not Before), and iat (Issued At).
Standard JWT Claims Reference
| Claim Key | Full Name | Expected Data Type | Security Purpose |
|---|---|---|---|
| exp | Expiration Time | NumericDate (UNIX seconds) | Rejects tokens used after expiration |
| iat | Issued At | NumericDate (UNIX seconds) | Determines token age and validity |
| sub | Subject | String / Number | Identifies user or system entity |
| iss | Issuer | String (URL or identifier) | Identifies the authentication provider |
Frequently Asked Questions
Does decoding a JWT require a secret key or private certificate?
No. The header and payload of a standard JWT are simply URL-safe Base64-encoded JSON strings, which can be inspected by anyone without a secret key. A cryptographic key is only needed to verify or forge the signature, not to read the contents.
How does the tool evaluate if a JWT is expired?
The decoder parses the registered exp (Expiration Time) claim, converts the UNIX epoch timestamp into a human-readable local datetime, and compares it in real time against the current client clock.
Is my authentication token transmitted across the internet?
No. The entire Base64URL decoding, claim extraction, and formatting execute 100% client-side inside your browser's local JavaScript memory. No tokens are sent over the network or logged.