What is in a JWT header?

The header contains metadata about the token. The most common fields are 'alg' (the signing algorithm, e.g. HS256, RS256) and 'typ' (the token type, usually 'JWT').

What algorithms are common in JWTs?

Common algorithms include HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), and ES256 (ECDSA-SHA256). The choice affects how the signature is verified.

What is the kid header parameter?

kid (key ID) names the key that signed the token. When an issuer rotates keys or publishes several in a JSON Web Key Set, the server that checks the signature uses kid to pick the matching key. The decoder shows kid as a plain string in the header JSON.

What does alg: none mean?

alg: none marks a token that carries no signature, so its third part is empty. The JWT specification allows it, but a server should refuse such a token unless it expects one, because anyone can create it. The decoder still shows the header and payload of a token like this.

JWT header decoder

Focus on the JWT header, the first section of a JSON Web Token. The header typically contains the signing algorithm (alg) and token type (typ). Paste your token to inspect it.

JWT token

⚠ Signature not verified, client-side only

VIEW

Runs entirely in your browser

How it works

A JWT consists of three Base64URL-encoded parts separated by dots. The tool splits the token, fixes URL-safe base64 encoding (replacing - with + and _ with /), pads to a multiple of 4 characters, then decodes the header and payload with atob() and parses them with JSON.parse(). The signature is not decoded. All of this runs in your browser. Our servers are not involved.

Processing runs in your browser

Your JWT is decoded entirely in your browser. Our servers are not involved at any point. Treat tokens as sensitive credentials and avoid pasting production tokens in shared or public environments. You can check this yourself in your browser's DevTools Network tab.

Technical specification

JSON Web Token (JWT) is defined in RFC 7519 (IETF, 2015). A JWT consists of three Base64url-encoded sections separated by .: header, payload, and signature. Base64url encoding is defined in RFC 4648 §5, which substitutes + with - and / with _ and omits padding, making it safe for use in URLs without percent-encoding. Signed JWTs (JWS) are specified separately in RFC 7515.

Structure: header.payload.signature (3 Base64url parts)
Standards: RFC 7519 (JWT), RFC 7515 (JWS), RFC 4648 (Base64url)
Header claims: alg (algorithm), typ (token type)
Common payload claims: sub, iss, exp, iat, aud

Related operations

To inspect the raw Base64 segments of a token, try Base64. For verifying the signing input by hash, use the hash generator. To pretty-print decoded payloads, see the JSON formatter.

Frequently asked questions

What is in a JWT header?: The header contains metadata about the token. The most common fields are 'alg' (the signing algorithm, e.g. HS256, RS256) and 'typ' (the token type, usually 'JWT').
What algorithms are common in JWTs?: Common algorithms include HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), and ES256 (ECDSA-SHA256). The choice affects how the signature is verified.
What is the kid header parameter?: kid (key ID) names the key that signed the token. When an issuer rotates keys or publishes several in a JSON Web Key Set, the server that checks the signature uses kid to pick the matching key. The decoder shows kid as a plain string in the header JSON.
What does alg: none mean?: alg: none marks a token that carries no signature, so its third part is empty. The JWT specification allows it, but a server should refuse such a token unless it expects one, because anyone can create it. The decoder still shows the header and payload of a token like this.

Last reviewed September 30, 2026

Other pages for this tool

Related tools

Background reading: Complete guide to developer tools