Understanding JWTs: what's actually inside that token

A JWT (JSON Web Token) is three base64url-encoded segments joined by dots: a header, a payload, and a signature. That's the entire format. Anyone can decode the header and payload without any secret — they're just base64, not encrypted — which is a detail that surprises a lot of people the first time they see it.

The three parts

• Header — usually just the algorithm used (like HS256 or RS256) and the token type.
• Payload — the actual claims: things like user ID, expiration time, issued-at time, and whatever custom data the issuer decided to include.
• Signature — computed from the header and payload using a secret key. This is the part that proves the token wasn't tampered with after it was issued.

The mistake this leads to

Because the payload is readable by anyone, JWTs should never contain sensitive data — passwords, full credit card numbers, private personal details. A surprising number of real-world bugs come from developers assuming a JWT is opaque or encrypted, then putting something sensitive in the payload. Decode any JWT with a basic tool and you can read every claim in plain text.

What the signature does and doesn't protect

The signature guarantees integrity — if anyone changes so much as one character of the payload, the signature no longer matches and a correctly implemented server will reject the token. It does not provide confidentiality. Readable and tamper-evident are different properties, and JWTs only give you the second one by default.

Expiration matters more than people think

JWTs are typically stateless — the server doesn't necessarily track which tokens it has issued, so there's often no way to individually revoke one before it expires. That makes the expiration claim (exp) load-bearing: a token issued with no expiration, or an unreasonably long one, stays valid indefinitely even if the associated account is later compromised or deactivated, unless the application does extra work to track revocation separately.

Processa's JWT decoder splits a token into its header, payload, and signature and pretty-prints the JSON — useful for debugging an auth flow without pasting a token into a random website.