How to decode a JWT

What is a JWT?

A JSON Web Token (JWT) is a compact, URL-safe token format used to transmit claims or information between two parties. JWTs are commonly used for authentication and authorisation in web applications: after a user logs in, a server issues a JWT that the client includes with subsequent requests to prove identity.

A JWT encodes information as JSON. It is designed to be small enough to pass in an HTTP header, a URL parameter, or a cookie.

What Does a JWT Look Like?

A standard compact JWT has three Base64URL-encoded sections separated by dots:

header.payload.signature

• Header — metadata about the token, typically the signing algorithm (alg) and token type (typ).
• Payload — the claims: statements about an entity (usually the user) and additional data.
• Signature — the cryptographic signature produced by the issuer, used to verify that the token has not been tampered with.

Each section is Base64URL-encoded so the token can travel safely through URLs and HTTP headers. The signature section is not decoded as JSON — it is the raw signature value.

What is a JWT Decoder?

A JWT decoder extracts the Base64URL-encoded header and payload and displays them as readable JSON. It also shows the signature segment and interprets common claims such as exp, iat and nbf.

Decoding is a read-only operation: it reveals information that is already encoded in the token. Because the header and payload are only encoded (not encrypted), anyone who has the token can decode them.

Is Decoding a JWT the Same as Verifying It?

No. Anyone can decode the header and payload of a JWT — no secret key is required. Decoding simply reverses the Base64URL encoding.

Verification is different: it uses the signing algorithm and a secret or public key to cryptographically confirm that the signature matches the header and payload, and that the token has not been altered since it was issued.

This tool decodes JWTs. It does not verify signatures. A decoded token may be expired, tampered with, or issued by anyone — decoding alone does not prove authenticity.

Is a JWT Encrypted?

Not by default. Standard JWT signing provides integrity and authentication, not confidentiality. The payload is encoded as Base64URL, which anyone can reverse.

If confidentiality is required, use an encrypted token format such as a JWE (JSON Web Encryption), or encrypt the payload before placing it in a JWT. Never place sensitive information such as passwords in a standard JWT payload unless your design specifically provides confidentiality.

What is the JWT Payload?

The payload is a JSON object containing claims. Claims are statements about an entity (typically the user) and additional metadata. There are three categories:

• Registered claims — a set of predefined claim names defined by the JWT specification, such as iss (issuer), sub (subject), exp (expiration), iat (issued at) and nbf (not before).
• Private claims — custom claim names agreed between the issuer and consumer, specific to a particular application.
• Public claims — claim names registered in a public registry to avoid collision.

What is the JWT Header?

The header is a JSON object that describes the token. It typically contains:

• alg — the signing algorithm used (for example, HS256, RS256, ES256).
• typ — the token type, usually JWT.
• kid — an optional key identifier hint indicating which key was used to sign the token.

The header does not verify itself. The alg value is a claim made by the token; a verifier must check that the algorithm is one it explicitly allows.

What is the JWT Signature?

The signature is the part of the token that allows a recipient to verify the token's integrity. It is produced by applying the signing algorithm to the encoded header and payload using a secret (for HMAC algorithms) or a private key (for RSA or ECDSA algorithms).

Verification requires the corresponding secret or public key. Without verification, the signature is just a string — you cannot tell whether it is valid by looking at it.

This tool displays the signature but does not verify it.

What Does exp Mean?

exp (Expiration Time) is a registered claim that identifies the time after which the JWT must not be accepted for processing. The value is a JWT NumericDate: seconds since the Unix epoch.

A verifier should reject any token whose exp is in the past. This tool interprets exp as seconds and shows both the raw value and a human-readable date.

What Does iat Mean?

iat (Issued At) is a registered claim that identifies the time at which the JWT was issued. The value is a JWT NumericDate (seconds since the Unix epoch).

iat can be used to determine the age of a token or to reject tokens that were issued too far in the future.

What Does nbf Mean?

nbf (Not Before) is a registered claim that identifies the time before which the JWT must not be accepted for processing. The value is a JWT NumericDate (seconds since the Unix epoch).

A verifier should reject any token whose nbf is in the future. This is useful for tokens that are issued in advance but should not be used immediately.

Should I Paste a Production JWT into an Online Decoder?

Only if you understand the privacy implications. A JWT payload can contain user IDs, email addresses, roles, permissions or session information. If the tool processes the token locally (as this one does) the token does not leave your browser, but you should still avoid pasting production authentication tokens into tools you do not fully trust.

If you need to inspect a production token, consider decoding it locally in your own environment, or redact sensitive claims before pasting it anywhere external.