A JWT is three base64url parts joined by dots: header.payload.signature. The header names the algorithm; the payload holds claims (data); the signature proves the token was not tampered with.
# Issue HS256 + RS256 tokens for your app
curl -X POST https://api.ifsjaipur.cloud/playground/auth/jwt/issue -u "APP_ID:APP_SECRET"
# Verify a token (signature + exp + aud)
curl https://api.ifsjaipur.cloud/playground/auth/jwt -H "Authorization: Bearer <jwt>"
# Decode WITHOUT verifying — see the parts
curl -X POST https://api.ifsjaipur.cloud/playground/auth/jwt/decode -H "content-type: application/json" -d "{\"token\":\"<jwt>\"}"Why the claims matter
| Claim | Meaning | Why check it |
|---|---|---|
| iss | issuer | Confirm who minted the token |
| sub | subject | Who/what the token represents |
| aud | audience | Reject tokens not meant for your service |
| iat | issued at | Know how old it is |
| exp | expiry | Reject expired tokens — the single most important check |
- HS256 signs with a shared secret (both sides hold it).
- RS256 signs with a private key; anyone can verify with the public key (fetch it at /playground/auth/jwt/public-key).
Tip · The /decode tool proves a crucial point: a JWT payload is just base64 — readable by anyone. Never trust its contents until you have verified the signature and exp.