Utilities Center

Guide

How JSON Web Tokens (JWT) Work and How to Decode Them

Learn the three parts of a JWT, what decoding reveals, and the security rules for using tokens safely.

Open the JWT Decoder

A JWT decoder splits a JSON Web Token into its header, payload, and signature and shows the payload as readable JSON. It is a debugging tool for anyone building or consuming authenticated APIs.

The three parts of a JWT

A JWT is three Base64url-encoded parts separated by dots: header.payload.signature. The header describes the token type and signing algorithm. The payload carries claims — statements about the user or session, such as an expiry time or user id. The signature lets the server verify the token has not been tampered with.

What decoding reveals

Decoding (as opposed to verifying) simply Base64-decodes the header and payload so you can read the claims. Common claims include "iss" (issuer), "sub" (subject), "exp" (expiry), and "iat" (issued-at). Decoding does not check the signature — anyone can decode a JWT; only the server with the secret can verify it.

How to use a JWT decoder

  1. Paste the full JWT (all three parts, separated by dots).
  2. Read the decoded header and payload as JSON.
  3. Check the expiry ("exp") to see if the token is still valid.

Examples

A token's payload might decode to {"sub":"12345","name":"Jane","exp":1735689600}, showing the user id, display name, and a Unix expiry timestamp. Converting 1735689600 to a date tells you when the token expires.

When a JWT decoder is useful

  • Debugging authentication failures in an API.
  • Inspecting claims without writing code.
  • Checking token expiry during a session issue.
  • Learning how JWT-based auth is structured.

Security rules

Never put secrets in a JWT payload — it is only encoded, not encrypted, and anyone can read it. Always verify the signature server-side before trusting any claim, and use HTTPS to keep tokens confidential in transit.

Put it into practice

Use the JWT Decoder right now — free, in your browser, no sign-up required.

Try the JWT Decoder

More guides

Back to all tools

Related free tools

More free online utilities that pair well with this one — same-category tools for the same task, plus handy extras from other categories.