JWT Decoder & Debugger Guide (RFC 7519)

JWT header, payload, and signature

In the usual JWS form, a token is three Base64URL segments separated by periods: header.payload.signature. The JWT header is JSON describing the token type and signing algorithm (often typ and alg). The JWT payload is JSON claims about the subject — for example sub, iat, exp, or nbf. The JWT signature is a cryptographic value over the header and payload; SparkJSON shows that third segment but does not recompute or verify it.

• Header — metadata such as alg and typ.
• Payload — claims such as sub, iat, exp, nbf.
• Signature — integrity proof; verify only with your real key, off this page.

Decode vs signature verification

Decoding Base64URL segments is safe to do in the browser and is what a JWT debugger is for. Signature verification proves the token was not altered and was signed by a trusted issuer — that requires a secret or public key. Never paste production signing keys into a website; verify JWTs in your backend with a maintained JWT library.

What SparkJSON’s tool does

Paste a token into the JWT decoder to see decoded header and payload JSON, readable exp/iat/nbf times, and warnings for expired tokens or alg:none. Processing stays in your browser. Encoding or generating new JWTs is not offered here today.