How to Decode a JWT (JSON Web Token) — Safely

A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and passing claims between systems. If you've ever needed to see what's insideone — who it's for, when it expires — this guide shows you how, and what to watch out for.

The three parts of a JWT

A JWT is three Base64url-encoded sections separated by dots: header.payload.signature.

• Header — the token type and signing algorithm (e.g. HS256).
• Payload — the claims: subject (sub), issued-at (iat), expiry (exp), and any custom data.
• Signature — proves the token wasn't tampered with, created using a secret or private key.

Decode it

Paste a token into our JWT decoder to instantly see the header and payload, with the iat and exptimestamps shown in human-readable form. Decoding happens entirely in your browser, so it's safe even for sensitive tokens.

Under the hood, the header and payload are just Base64url — the decoder simply decodes those two sections and pretty-prints the JSON.

Decoding is not verifying

This is the crucial part: anyone can decode a JWT — the payload is not encrypted, only encoded. Decoding tells you what the token claims, but not whether it's genuine.

Verifyingis different: it checks the signature against the secret or public key to confirm the token is authentic and unaltered, and that it hasn't expired. Verification must happen on the server — never trust a token's contents based on decoding alone.

Security tips

• Never put secrets or sensitive personal data in the payload — it's readable by anyone.
• Always check the exp claim and reject expired tokens.
• Verify the signature on the server with the correct algorithm; don't accept alg: none.
• Signatures rely on cryptographic hashing — keep your signing secret truly secret.

FAQ

Is the payload encrypted?

No — it's Base64url-encoded and fully readable. Treat everything in it as public.

Can I edit a JWT?

You can change the payload, but without the signing secret you can't produce a valid signature, so a server that verifies properly will reject it.