JWT Decoder Guide: What Is a JSON Web Token and How to Decode It Safely

JSON Web Tokens (JWTs) are everywhere in modern login systems and APIs. If you have ever seen a long string starting with eyJ, you have probably seen one. Here is what is inside and how to read it with the JWT Decoder.

The three parts of a JWT

A JWT looks like xxxxx.yyyyy.zzzzz:

1. Header — the token type and signing algorithm, for example {"alg":"HS256","typ":"JWT"}.
2. Payload — the “claims”: data about the user and the token.
3. Signature — proves the header and payload were not changed, using a secret or a private key.

The header and payload are only Base64URL-encoded, not encrypted. You can see this yourself with the Base64 Encoder/Decoder.

Common claims you will see

• sub — subject: who the token is about (often a user ID).
• iss — issuer: who created the token.
• aud — audience: who the token is meant for.
• iat — issued at, as a Unix timestamp.
• exp — expiry time, as a Unix timestamp.
• nbf — not valid before this time.

Timestamps are in seconds since 1 January 1970 (UTC). Paste them into the Unix Timestamp Converter to see the real date and time.

How to decode a JWT

1. Copy the token (without the word “Bearer”).
2. Paste it into the JWT Decoder.
3. Read the decoded header and payload, and check the expiry time.

Decoding is not verifying

A decoder only reads the token. It cannot tell you whether the signature is valid — that needs the secret or public key, and should happen on your server using a well-maintained library. Never trust a token’s claims just because they decode correctly.

Security tips

• Don’t put secrets in the payload — anyone holding the token can read it.
• Treat tokens like passwords: a valid token can let someone act as you until it expires.
• Prefer short expiry times and refresh tokens for long sessions.
• Reject alg: none and pin the algorithms your server accepts.
• Be careful where you paste live tokens. Our decoder runs in your browser, but if in doubt, use an expired or test token.

More helpers: JSON Formatter, Hash Generator and the full list of free developer tools. New to JSON? Start with our JSON formatting guide.

Example: decoding a JWT step by step

A JWT has three parts separated by dots: header.payload.signature. Each of the first two parts is Base64URL-encoded JSON. For example:

• eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 decodes to {"alg":"HS256","typ":"JWT"} — the token is signed with HMAC-SHA256.
• eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFzaGEiLCJleHAiOjE3NjcyMjU2MDB9 decodes to {"sub":"1234567890","name":"Asha","exp":1767225600}.
• The exp value 1767225600 is a Unix timestamp: 1 January 2026, 00:00 UTC. Convert any timestamp with the Unix Timestamp Converter.

Paste a token into the JWT Decoder to see the same breakdown automatically. Decoding happens in your browser, so the token is not sent anywhere.

Standard claims you will see

• iss — issuer (who created the token).
• sub — subject (usually the user ID).
• aud — audience (which app the token is for).
• exp, nbf, iat — expiry, “not before” and “issued at” times in Unix seconds.
• jti — a unique token ID, useful for blocking a single token.

Common JWT problems and fixes

• “Token expired”: compare exp with the current time; servers often allow only a few seconds of clock difference.
• “Invalid signature”: the secret or public key on the server does not match the one used to sign, or the token was changed.
• Decoding fails: the token was cut off when copying, or it includes the word “Bearer ” in front — remove it.

Frequently asked questions

Is decoding a JWT the same as verifying it?

No. Anyone can decode the header and payload because they are only encoded, not encrypted. Verifying checks the signature with the secret or public key, which only the server should do.

Is it safe to paste my token into a decoder?

Only use decoders that work in your browser, like ours, and never paste live production tokens into sites that send them to a server. For extra safety, use expired or test tokens.

Can a JWT be encrypted?

Yes. Encrypted tokens use a related standard called JWE and have five parts instead of three. A normal decoder cannot read their contents without the key.

Where should I store a JWT in a web app?

Many teams prefer secure, HttpOnly cookies because scripts cannot read them, which reduces the damage from cross-site scripting. Whatever you choose, keep tokens short-lived.