JWT Decoder
Online

JWT (JSON Web Token) is a compact token for transmitting data between parties. It consists of three parts separated by dots: a header (signing algorithm), a payload (data/claims), and a signature for integrity verification.

The server creates a JWT after a successful login and sends it to the client. The client attaches the token to every request in the Authorization header. The server verifies the token signature and extracts data from the payload.

Yes, decoding happens entirely on the client side -- the token is never sent to a third-party server. But remember that JWT contents are not encrypted, only signed, so never put sensitive data inside the payload.

A JWT is stored on the client and contains all its data within itself (stateless), while a session is stored on the server by identifier. JWT is easier to scale in distributed systems, but revoking a specific token before it expires is more difficult.