How to Read a JWT Token (Without Guessing)

A JWT (JSON Web Token) looks like a wall of random characters, but it's really just three pieces of JSON glued together with dots: header.payload.signature. Paste one into the JWT Decoder and the header and payload pop out as readable JSON immediately: no library, no server, nothing installed.

The three parts

• Header — usually just the algorithm and token type, e.g. {"alg":"HS256","typ":"JWT"}.
• Payload — the actual claims: who the token is for, when it expires, and whatever custom data your app put in it.
• Signature — a cryptographic signature over the header and payload, computed with a secret or private key the server holds. This is the part you can't read, and it's the whole point: it's what proves the token wasn't tampered with.

Why you can read the payload without a secret

This surprises people the first time: the header and payload aren't encrypted, they're just base64url-encoded, which is a reversible encoding, not a cipher (see Base64 vs. Encryption if that distinction is new to you). Anyone can decode them with nothing more than a base64url decoder. That's why you should never put secrets — passwords, API keys, credit card numbers — inside a JWT payload: "inside a JWT" is not the same as "encrypted."

The claims worth knowing

Most payloads use a handful of standard claim names:

• exp — expiration time, as a Unix timestamp. Paste it into the Timestamp Converter to see exactly when the token dies in your local time.
• iat — issued-at time, also a Unix timestamp.
• sub — the subject, typically a user ID.
• iss / aud — who issued the token, and who it's intended for.

Anything past those is usually app-specific: roles, scopes, permissions, tenant IDs.

Step-by-step: decoding one yourself

1. Copy the full token, including both dots.
2. Paste it into the JWT Decoder.
3. Read the Header and Payload panels, shown as formatted JSON.
4. Check the expiry badge to see at a glance whether exp has already passed.

What decoding does not tell you

Decoding proves nothing about whether the token is genuine. An expired, forged, or hand-edited token decodes exactly like a valid one; only verifying the signature server-side (with the actual secret or public key) tells you whether to trust it. Treat a decoder as a read-only inspector for debugging, never as proof a token is valid.