How to Decode a JWT (JSON Web Token)

A JWT (JSON Web Token) looks like a random string, but it's really three readable parts bolted together. Decoding it takes seconds once you know the structure — and knowing what decoding does not prove is just as important.

The three parts of a JWT

A JWT is three Base64URL-encoded segments separated by dots:

header.payload.signature

Header — JSON describing the token, usually the signing algorithm (alg) and type (typ).
Payload — JSON holding the claims: who the token is about (sub), who issued it (iss), when it expires (exp), and any custom data.
Signature — a cryptographic check the server uses to confirm the token wasn't tampered with.

How decoding works

The header and payload are only Base64URL-encoded, not encrypted. Decoding is just reversing that encoding to reveal the JSON inside — which is why any JWT decoder can show you the contents instantly, without a secret key. (If you're new to Base64, see What Is Base64 Encoding?.)

Decoding is not verifying

This is the part that trips people up: decoding a JWT tells you what it claims, not whether it's genuine. Anyone can read — and even edit — the payload, because reading requires no key. Only the signature proves the token is authentic, and checking it requires the server's secret or public key.

So never trust a decoded payload for authorization decisions on the client. Decode to inspect and debug; verify on the server to trust. See our Security & Data Handling page for more on this distinction.

What to look for in the payload

exp — expiry, as a Unix timestamp. An expired token should be rejected.
iat — issued-at time.
sub — the subject (often a user ID).
iss / aud — issuer and intended audience.

A JWT is Base64url-encoded and signed, not encrypted, so its payload is readable by anyone — see Encoding vs Encryption vs Hashing and Base64 Is Not Encryption. To use tokens for auth, see How JWT Authentication Works in Web Security Essentials.

Try it

Paste a JWT to decode its header and payload instantly. It runs entirely in your browser — your token is never uploaded to a server.