JWTs are everywhere in modern authentication — and most developers can decode one but couldn't tell you whether the signature checks out. This guide closes that gap.
The three parts
Header.Payload.Signature, each base64url-encoded and separated by dots. Decoding the first two parts is trivial — they're just base64 of JSON.
Decoding isn't verifying
Anyone can decode a JWT and read its claims. Only the holder of the signing key can verify the signature. Never trust JWT contents without verifying first.
Common claims
iss (issuer), sub (subject), exp (expiration), iat (issued-at), aud (audience). Custom claims live alongside these in the payload.