JWT decoder · Guide
JWT Header vs Payload: What Goes Where
A JWT has three parts, and the first two carry very different information. Knowing what belongs in each makes tokens far easier to read.
The header: how it is signed
The header is metadata about the token itself — primarily the signing algorithm (alg) and type (typ). It tells a verifier how to check the signature.
The payload: the claims
The payload holds the claims: who the token is about (sub), who issued it (iss), when it expires (exp) and any custom data. These are readable by anyone, so never put secrets here.
The signature binds them
The signature is computed over the header and payload. Change either and the signature no longer matches, which is how tampering is detected during verification.
Frequently asked questions
Can I use this for production work?
Yes, for inspection, formatting and quick generation. Still review the output before committing it to production code or configuration.
Ready to try it?
Open the free browser-based JWT decoder and apply what you just read — no sign-up, runs locally.
Open the JWT decoder tool