What is JWT?
A plain-English definition, and the tools that work with it.
A JWT (JSON Web Token) is a compact, signed token used to prove identity between systems: most commonly to keep a user logged in via an API. It packs claims (like a user ID and expiry) into a Base64 string with a signature that lets the server verify it wasn't tampered with.
- A JWT has three dot-separated parts (header, payload, signature) each Base64-encoded.
- The payload is encoded, not encrypted: anyone can read it, so never put secrets in a JWT.
- The signature is what matters. It proves the token is authentic and unmodified.
Tools for JWT
Free, private and in your browser. No sign-up.
JWT Decoder
Decode and inspect any JSON Web Token instantly. Read the header, payload and signature, see when it was issued and expires, and optionally verify an HS256 signature. 100% in-browser. Your token never leaves your device.
Base64 Decoder
Decode Base64 back to text or a file instantly: Unicode-safe, auto-detects URL-safe input, sniffs binary data and offers a download. Runs fully in your browser, nothing uploaded.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any text or file at once, generate HMAC signatures with your own key, and verify a download against its expected hash, all in your browser, nothing uploaded.
JSON Formatter
Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.
Frequently asked questions
Related terms
- Base64Base64 is a way of encoding binary data (like an image or file) into plain ASCII text using 64 safe characters. It lets you embed or transmit binary content through systems that only handle text, such as email, JSON or data URIs.
- JSONJSON (JavaScript Object Notation) is a lightweight, text-based format for structured data, built from key–value pairs and lists. It's the standard way apps and APIs exchange data because it's easy for both humans and machines to read.
Keep exploring
Related tools
Problems we solve
Definitions
From the blog
- Better AI Prompts: A Practical Guide to Getting Useful Answers
- What Is a Token, Exactly? The Tiny Unit AI Bills You By
- HTTP Security Headers Explained: CSP, HSTS, and the Rest
- How to Generate TypeScript Types from JSON (API Responses Made Type-Safe)
- How Large Language Models Actually Work (In Plain English)
Common tasks
Try JWT Decoder
Free, private and instant. Everything runs in your browser.