How to Decode a JWT (Header, Payload, and a Safety Note)

Staring at a login bug and need to know whether a token has expired or carries the right claims? Reading the inside of a JWT takes seconds — here is how, plus an important safety note about what decoding does and doesn't prove.

What a JWT looks like

A JWT has three Base64URL parts separated by dots:

header.payload.signature

• Header — the algorithm and token type.
• Payload — the claims (user id, expiry exp, issuer iss, etc.).
• Signature — proves the token was not tampered with.

Decode it

Open the free JWT Decoder and paste your token. It shows the header and payload as readable JSON, which you can copy.

Important: decoding is not verifying

Anyone can decode a JWT — the header and payload are only Base64-encoded, not encrypted. Decoding does not check the signature, so never trust a token's contents based on decoding alone. Signature verification must happen on your server with the secret or public key. Our JWT Decoder deliberately decodes only and never verifies signatures.

Tips

• The payload is JSON — pretty-print or validate it with the JSON Formatter.
• To understand Base64URL itself, try the Base64 Encoder/Decoder.

Frequently asked questions

Is it safe to paste a token here? Decoding happens in your browser and nothing is uploaded. Still, avoid sharing live production tokens.

Why can't I see the signature contents? The signature is a cryptographic value, not readable data; it is used to verify, not to read.

When a decoder isn't the right tool

A decoder is a debugging aid, not a security check — reach for something else in these cases. If you need to confirm a token is authentic and unexpired, that's signature verification, which belongs in your backend with the signing key (a library like jose or jsonwebtoken), never in a browser. If the token is a JWE (encrypted JWT) rather than a signed JWS, the payload won't be readable here at all without the decryption key. And if you're trying to read an opaque session token — a random database key with no dots — it isn't a JWT and there's nothing inside to decode. For those, check your session store directly.