Quick answerUnderstand the JWT token format, the three dot-separated segments, Base64url encoding, common errors, and how to format a token as readable JSON.

What is the JWT token format?

A common signed JSON Web Token is serialized as three Base64url-oriented segments separated by periods: header.payload.signature. The header and payload encode JSON objects; the signature segment carries a cryptographic value. The dots delimit the segments.

A compact token is intentionally dense for transport. A JWT formatter makes the header and claims readable, but the formatted JSON is only an inspection view—it doesn't prove who issued the token or whether its signature is correct.

A JWT format example

ILLUSTRATIVE TOKEN SHAPENOT A CREDENTIAL
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiJkZW1vIiwiaWF0IjoxNzY3MjI1NjAwfQ
.
ZGVtby1zaWduYXR1cmU

Line breaks are shown here only to make the three parts easier to see; a compact token is normally pasted as one continuous string. The example's signature text is illustrative and must not be interpreted as a valid signature for a real service.

Base64url encoding and padding

In the compact representation, the header and payload are Base64url-encoded. This variation replaces + with - and / with _; padding characters are omitted in the JWS compact representation. A decoder may need to restore padding internally before using a general Base64 decoder.

Encoding is not encryption. The payload may contain names, IDs, roles or timestamps, so treat a token as sensitive even when its contents are easy to read. Avoid writing raw tokens to logs, sharing them in support tickets, or including them in screenshots.

Formatting is not validation

A formatter turns encoded JSON into readable JSON and may translate NumericDate claims such as exp, nbf and iat into dates. A validator does more: it checks cryptographic integrity with a trusted key and applies required issuer, audience, time and application rules.

Even a tool that offers validation can only produce a meaningful result when it has the correct verification key and expected policy. A generic decoder without those inputs should never label a token “valid” simply because its JSON parses.

Why a JWT may not decode

  • Copying extra text: remove surrounding quotes and unrelated labels. If the copied value begins with Bearer, a tool may accept it as an authorization prefix.
  • Incorrect number of periods: signed compact tokens commonly contain two periods separating three segments; encrypted compact JWE uses a different five-segment structure.
  • Malformed Base64url: a segment may have been truncated or transformed by a transport layer.
  • Not JSON: the decoded bytes must parse as a JSON object for the header and claims set.
  • Wrong token type: an opaque access token or another protocol value may look like a string but is not a JWT.

Use the JWT formatter to inspect structure, then read the JWT token parts guide to understand each segment.

A safer JWT debugging workflow

  1. Use a development token or a controlled test value when possible.
  2. Decode the header and payload to inspect fields and timestamps.
  3. Compare the issuer, audience and time claims with the expected integration contract.
  4. Validate the signature and claims with the same maintained library and configuration used by the application.
  5. Never change authorization decisions based only on values displayed by a formatter.

If the token appears structurally correct but an API still rejects it, investigate key rotation, clock skew, issuer/audience mismatch and the server-side validation policy.

References and further reading

Primary standards and documentation used to support this guide.

Frequently asked questions

What characters separate the parts of a JWT?

Periods separate the segments in compact JWT serialization.

Is a JWT Base64 or Base64url?

Compact JWT/JWS components use Base64url encoding, a URL-safe variation of Base64 with hyphen and underscore replacements and omitted padding.

Can a JWT formatter fix a broken token?

It can help locate structure, encoding or JSON errors. It cannot reconstruct missing original bytes or prove a token is authentic.

Does a JWT formatter need a secret key?

No key is needed simply to decode and format the header and payload. A correct key and verification policy are needed to verify a signature.

Keep learning

Put the explanation to work.

Inspect a token in the browser-based JWT formatter, then use the claims reference when you need to understand a field.

Open JWT inspector