What Is a JWT and How to Decode It (Safely)

A JWT (JSON Web Token) is a compact, URL-safe token made of three parts — header, payload and signature — joined by dots: header.payload.signature. Decoding it just means Base64url-decoding the first two parts to read their JSON.

The three parts

• Header — the token type and signing algorithm, e.g. {"alg":"HS256","typ":"JWT"}
• Payload — the claims (data), such as user id, roles and an expiry time
• Signature — a cryptographic check that the header and payload were not altered

Decoding is not verifying

This is the key point for security: anyone can decode a JWT and read the payload — it is encoded, not encrypted. The signature only proves the token is genuine if you verify it with the secret or public key. So:

• Never put passwords or secrets in the payload — it is readable by anyone.
• Never trust a token just because it decodes; the server must verify the signature.

Reading claims

Standard claims include exp (expiry), iat (issued-at) and sub (subject). An expired exp means the token should be rejected even if the signature is valid.

Decode one now

Paste a token into the JWT decoder to inspect its header and payload instantly, in your browser — the token never leaves your device. Curious about the encoding underneath? See the Base64 encoder/decoder. Related: What is JSON and how to format it.