How to Decode a JWT (JSON Web Token)

A JWT looks like gibberish — three chunks of random characters separated by dots. But it is not encrypted; it is merely encoded, and anyone can read what is inside. Decoding a JWT reveals the claims it carries: who the user is, what they can do, and when the token expires. For developers debugging authentication, this is a daily need. This guide explains the structure of a JWT, what decoding shows, and the critical security point everyone must understand.

The three parts of a JWT

A JWT has three Base64URL-encoded sections joined by dots:

• Header — the token type and the signing algorithm used.
• Payload — the claims: user ID, roles, issue time, expiry, and any custom data.
• Signature — a cryptographic check that proves the token has not been tampered with.

The dots separate them. Decoding reads the header and payload; the signature is verified with a secret key, not read.

How to decode a JWT with this tool

1. Open the JWT Decoder tool.
2. Paste the token.
3. Read the decoded header and payload.

Everything runs in your browser, so the token is never uploaded. This is essential: a JWT often grants access to an account, so pasting it into a server-side website would hand your session to a stranger. Local-only decoding is the safe way.

The security truth: encoded, not encrypted

This trips up newcomers constantly. A JWT payload is not secret. Base64 is encoding, not encryption — anyone who has the token can decode and read every claim in it. The consequences:

• Never put sensitive data in a JWT payload. No passwords, no secrets, no private personal data. Assume the client can read it, because they can.
• The signature provides integrity, not secrecy. It proves the token was not altered, but does nothing to hide the contents.
• Trust comes from verifying the signature server-side with the secret key — not from the payload looking valid.

Reading the important claims

• `exp` — expiry, as a Unix timestamp. Convert it with Timestamp Converter to see the real date and check whether the token is stale.
• `iat` — when it was issued.
• `sub` — the subject, usually the user ID.
• Custom claims — roles, permissions, tenant, and so on.

Common uses

• Debug an auth flow by inspecting what the token actually contains.
• Check why a token is rejected — often it has simply expired.
• Confirm the claims your backend is issuing.

Related tools

The payload is JSON, so JSON Formatter helps read a large one. For general encoding questions, Base64 Encoder/Decoder shows the layer underneath a JWT's parts.

Privacy and limits

Decoding is fully local — no upload, no size limit, nothing stored, offline once loaded. Open the JWT Decoder tool to see inside your tokens safely.