JWT & Authentication· Updated 2026-08-30· 4 min read

JWT Decoding vs Verification: What is the Difference?

JSON Web Tokens (RFC 7519) are widely used for stateless authentication. However, developers frequently confuse client-side decoding with cryptographic verification, creating severe security vulnerabilities.

The Structure of a JWT

A JWT is composed of three Base64URL-encoded strings separated by periods (header.payload.signature): 1. Header: Specifies the signing algorithm (e.g. RS256, HS256) and token type. 2. Payload: Contains claims (e.g. user ID, role, expiration timestamp). 3. Signature: Cryptographic hash created by the server using its private key or secret.

Decoding converts Base64URL into JSON without validating cryptographic signatures.

Raw Encoded JWT (Base64URL)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Decoded Payload Claims

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Interactive Tool

JWT Decoder

Decode Synthetic JWT

Inspect claims, header parameters, and expiration timestamps in JWT Decoder.

Preset Payload

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Standards & References