JWT Explained: What's Actually Inside That Token (with a free decoder)

If you've ever worked with auth, you've seen a JWT — a long string like eyJhbGci... split into three parts by dots. It looks cryptic, but it's surprisingly simple once you see inside.

A JWT has three parts

header.payload.signature

Header – tells you the signing algorithm, e.g. {"alg":"HS256","typ":"JWT"}

Payload – the claims (the actual data), e.g. {"sub":"123","name":"John","iat":1516239022}