JWTs explained: what's actually inside a token
A JSON Web Token is three Base64url-encoded segments joined by dots: header.payload.signature. It's a compact, self-contained way to represent claims — "this user is
logged in as Ada, and this token expires at 3pm" — that a server can verify without a database lookup.
The header
A small JSON object describing the token itself — typically just the signing algorithm (alg, e.g. HS256 or RS256) and the token type (typ: "JWT").
The payload
The actual claims — arbitrary JSON, though a handful of field names are standardized: sub (subject,
usually a user id), iat (issued-at time), exp (expiration time), and nbf
(not-before time). The last three are Unix timestamps in seconds, not milliseconds — a common source of bugs when
mixing them with JavaScript's Date, which expects milliseconds.
Important: it's encoded, not encrypted
This is the single most common misunderstanding about JWTs. Base64url is just an encoding — anyone who has the token can decode the header and payload instantly and read every claim inside, with no key required. That's exactly what hexnook's JWT decoder does. Never put a secret (a password, an API key) directly inside a JWT's payload expecting it to stay hidden.
The signature
What actually makes a JWT trustworthy is the signature — a cryptographic proof that the header and payload haven't been tampered with since the token was issued. There are two broad families:
- HMAC (HS256, HS384, HS512): symmetric — the same secret both signs and verifies the token. Anyone with the secret can also forge new tokens, so it only works when the signer and verifier are the same trusted party (or share the secret securely).
- Asymmetric (RS256, ES256, and similar): a private key signs, and the corresponding public key verifies. This is what lets a third party verify a token's authenticity without being able to forge new ones — common for identity providers like Auth0 or Google.
hexnook's decoder can verify HMAC signatures client-side, since that only needs the shared secret you provide. Asymmetric algorithms need the issuer's public key to verify, which the decoder doesn't have — so those tokens are decode-only.