FileGizmo glossary
JWT
A JWT, or JSON Web Token, is a compact string that carries a set of claims such as who a user is and when their session expires. It has three parts separated by dots, a header, a payload, and a signature. The signature lets a server confirm the token was not tampered with.
Why JWTs exist
Web apps need a way to remember that you logged in without asking for your password on every click. A JWT solves that. After you sign in, the server hands your app a signed token, and the app presents it on later requests as proof of who you are.
The clever part is the signature. Anyone can read a JWT, but only the server holding the secret key can produce a valid signature, so a tampered token is rejected immediately.
How to read one safely
You will often want to see what a token actually contains while debugging.
- Open the JWT decoder.
- Paste the token to see its header and payload in plain text.
- Check the claims and expiry without sending the token anywhere.
The decode happens entirely in your browser, which matters because a live token is a key to an account, not just a piece of text.
Frequently asked questions
What are the three parts of a JWT?
A header describing the algorithm, a payload holding the claims, and a signature. The header and payload are Base64url-encoded JSON, so they are readable by anyone. The signature is what proves the token is authentic.
Is the data inside a JWT encrypted?
No. A standard JWT is signed, not encrypted, so anyone with the token can read the payload. Never put secrets like passwords in a JWT, and never trust its contents until you have verified the signature.
Why should I not paste a JWT into a random website?
A token often grants access to an account. Pasting it into an unknown site can hand that access to a stranger. Decode tokens locally so the value never leaves your browser.