How JWT works

Read the parts

A common signed JWT has three dot-separated parts: a header, a payload and a signature. The first two use base64url-encoded JSON. Decoding those parts does not establish who created the token.

header.payload.signature

Treat claims as untrusted

The payload can contain issuer, audience and time claims. A real application must validate the signature, allowed algorithm, issuer, audience and applicable time constraints before trusting it. Quietkit only displays decoded values.

exp: expiration time; nbf: not before; iat: issued at

Protect the token

A token can grant access even when its payload is readable. Use an example rather than a live credential when learning. Quietkit processes tokens locally and does not offer token-sharing links. Encrypted JWT formats are outside this decoder’s scope.