developerOctober 24, 2026•2 min read•ToolsHub Editorial Team

Understanding JSON Web Tokens (JWT): Header, Payload & Signature

Deep dive into JSON Web Tokens (JWT). Learn how base64url encoding, claims, and HMAC/RSA digital signatures secure modern stateless web APIs.

Share guide:X / Twitter LinkedIn

Related Online Tool

Try the JWT Decoder

Calculate your numbers instantly in your browser. Fast, free, no signup.

Open Tool

In modern single-page applications (SPAs) and microservice architectures, JSON Web Tokens (JWT) serve as the industry standard (RFC 7519) for transmitting authentication and authorization claims statelessly.

Anatomy of a JWT

A compact JWT string consists of three distinct segments separated by periods (.):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

1. Header (Red)

Specifies the token type and cryptographic signing algorithm (such as HS256 or RS256):

{ "alg": "HS256", "typ": "JWT" }

2. Payload (Purple)

Contains claims—assertions about an entity (typically the user) and metadata:

{
  "sub": "usr_948291",
  "name": "Alex Developer",
  "role": "admin",
  "exp": 1740000000
}

3. Signature (Blue)

Created by taking the encoded header, encoded payload, a secret key, and hashing them together:

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

Inspect Your Tokens: Debug and decode your tokens safely with our private JWT Decoder.

3 Critical JWT Security Warnings

Never Store Secrets in the Payload: Passwords, API tokens, and social security numbers must never be included in a JWT because payload bytes are public.
Always Validate the Signature on the Backend: Blindly trusting the payload without cryptographic signature verification allows attackers to tamper with user roles.
Use HTTPS Exclusively: Because JWTs function as bearer tokens, an eavesdropper intercepting the HTTP request gains full account impersonation privileges.

Frequently Asked Questions

What are the 3 parts of a JWT?

A JWT consists of three parts separated by dots (.): Header, Payload, and Signature (e.g., xxxxx.yyyyy.zzzzz).

Is data inside a JWT encrypted?

No! Standard JWTs are signed, not encrypted. The header and payload are simply Base64Url-encoded JSON strings that anyone can decode and read.

How do I safely inspect a JWT in my browser?

Use our client-side JWT Decoder to inspect claims without sending confidential tokens to remote servers.

Share guide:X / Twitter LinkedIn

← Back to all guides

ToolsHub Editorial Team

Verified Author

Technical Architect & Lead Developer • ToolsHub Pro

Abdul Nabi is a senior software engineer and technical architect specializing in client-side Web APIs, high-performance browser computing, cryptographic validation, and privacy-first digital utility platforms. All guides on ToolsHub Pro are peer-reviewed for mathematical rigor and developer accuracy.

Published on ToolsHub Pro • 100% Client-Side Free Tools

Author Profile GitHub

Recommended Tools

developer

Base64 Encoder / Decoder

Encode and decode Base64 instantly.

developer

Hash Generator

Generate SHA-256, SHA-1 and DJB2 hashes.

Related Guides

Guide

Convert Yaml To Json Browser

Anatomy of a JWT

A compact JWT string consists of three distinct segments separated by periods (.):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

1. Header (Red)

Specifies the token type and cryptographic signing algorithm (such as HS256 or RS256):

{ "alg": "HS256", "typ": "JWT" }

2. Payload (Purple)

Contains claims—assertions about an entity (typically the user) and metadata:

{ "sub": "usr_948291", "name": "Alex Developer", "role": "admin", "exp": 1740000000 }

3. Signature (Blue)

Created by taking the encoded header, encoded payload, a secret key, and hashing them together:

HMACSHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

Inspect Your Tokens: Debug and decode your tokens safely with our private JWT Decoder.

3 Critical JWT Security Warnings

Never Store Secrets in the Payload: Passwords, API tokens, and social security numbers must never be included in a JWT because payload bytes are public.

Always Validate the Signature on the Backend: Blindly trusting the payload without cryptographic signature verification allows attackers to tamper with user roles.

Use HTTPS Exclusively: Because JWTs function as bearer tokens, an eavesdropper intercepting the HTTP request gains full account impersonation privileges.