ToolStop
Definition

What is JWT (JSON Web Token)?

A JWT is a compact, URL-safe token made of three Base64 parts — header, payload, signature — used to prove who is making an API request.

Also called: JSON Web Token · bearer token

A JWT looks like xxxxx.yyyyy.zzzzz. The first part says which signing algorithm is used, the second is a JSON object with claims like the user ID and expiry, and the third is a cryptographic signature that lets the server confirm the token wasn't tampered with.

Because the payload is only Base64-encoded, anyone can read it — you should never put passwords or secrets inside a JWT. The safety comes from the signature, which requires a private key or shared secret to forge.

JWTs are the default session format for most modern APIs, single-page apps, and OAuth 2.0 / OpenID Connect flows.

Try a tool that uses JWT (JSON Web Token)

JWT Decoder

Decode JWT header and payload claims safely in your browser.

Base64 Decoder

Decode Base64 strings back to readable text.

Hash Generator

Compute SHA-1, SHA-256, SHA-384, and SHA-512 hashes.

Related definitions

Base64

Base64 is an encoding that turns any binary data — images, files, credentials — into a string of 64 safe ASCII characters that can travel through text-only systems.

Regex (Regular Expression)

A regex is a mini-language for describing text patterns — used to find, validate, or replace substrings in a larger body of text.

Cron

Cron is a Unix scheduler that runs commands on a recurring timetable — every minute, every Monday at 6 AM, the first of every month, and so on.

Hash Function

A hash function maps any input — a password, a file, a message — to a fixed-length string that acts as a fingerprint of the original.