Encoders / DecodersLesson 16Free preview
JWT Decoder
This lesson is part of Web Developer Tools · All levels
Summary
The JWT Decoder breaks the JSON Web Token into three parts: header, payload, and signature. The header and payload are encoded with Base64URL, so they can be read without a secret key. Decoding only displays the content of the token; the tool does not verify the signature or validity of the token. Since payloads can be read by anyone, confidential data should not be stored in JWT.
Key points
- The JWT consists of three parts separated by a point: header.payload.signature
- Header and payload use Base64URL encoding, not encryption
- Decoding does not prove a token valid or authentic
- Verification of signature requires a suitable secret or public key
- Do not store passwords or sensitive data in the payload
Full lesson
Code examples and quizzes
Full lessons, code examples, and quizzes are available to subscribers. 5 questions.