How to Decode a JWT and Read Its Claims
JWTs carry claims in a readable payload, but only after base64url decoding. This guide explains the three parts of a token and what to check.
What is the JWT Decoder?
A JWT has three base64url-encoded parts separated by dots: header, payload and signature. This tool decodes the first two parts and pretty-prints them as JSON so you can inspect claims such as expiry and issuer. The signature is NOT verified here, so a readable token is not proof that it is valid or trusted.
How to use it
- Paste the JWT into the box.
- Click Decode JWT.
- Read the header and payload JSON shown below.
Worked example
Decoding the sample token shows a header with alg HS256 and typ JWT, and a payload with sub 1234567890, name John Doe and iat 1516239022.
What are the three parts of a JWT?
Header, payload and signature, separated by dots. The header names the signing algorithm and the payload carries the claims; the signature is what proves the token was issued by a trusted party.
Frequently asked questions
Does decoding a token prove it is valid?
No. Decoding only reads the contents; it does not check the signature, expiry or issuer, so never trust a token on readability alone.
Is my token sent to a server?
No. Decoding happens locally in your browser and the token is never uploaded.