UsefulTab

How to decode a JWT and read its claims

A JSON Web Token (JWT) looks like a long, opaque string, but it is really three readable parts bundled together. This guide explains what is inside one, how to read it, and the one thing developers most often get wrong — confusing decoding with verifying — all done locally so your token never leaves your browser.

The fastest way

Paste your token into the JWT Decoder and it splits out the header and payload as formatted JSON instantly. The rest of this guide explains what you're looking at.

Anatomy of a JWT

A JWT is three Base64URL sections separated by dots:

Each part is just Base64URL text, which is why it can be decoded without any key. If you want to decode the parts by hand, the Base64 tool will do the raw step — but the JWT Decoder handles the dots and URL-safe alphabet for you.

Decoding is not verifying

This is the critical point. Decoding reveals the contents; it does not check the signature. A decoded token tells you what it claims, not whether those claims are trustworthy or current. Verifying — confirming the signature with the secret or public key, and checking the expiry — is a server-side step. Never treat a token as valid just because you could read it.

Reading the claims

Common payload claims: sub (who the token is about), iss (issuer), aud (intended audience), iat (issued at), and exp (expiry). The time claims are Unix timestamps in seconds — large integers you can convert to a readable date if needed.

A note on privacy

A JWT is frequently a live session credential — pasting it somewhere that logs it could hand over an account. The JWT Decoder runs entirely in your browser, so the token is never uploaded or stored.

Open the JWT Decoder →

Common questions

What are the three parts of a JWT?

A JWT is three Base64URL-encoded sections joined by dots: the header (the signing algorithm and token type), the payload (the claims — the actual data, like user id and expiry), and the signature (which proves the first two parts were not tampered with). Decoding reveals the header and payload; the signature is only meaningful when verified with the key.

Is decoding a JWT the same as verifying it?

No, and this is the important part. Decoding just Base64URL-decodes the header and payload so you can read them — it does not check the signature, so a decoded token is not proof the token is genuine or unexpired. Verification requires the secret or public key and happens on your server, never in a decoder.

Is it safe to paste a token into an online decoder?

Only if the decoder runs in your browser. A JWT often is the live credential for a session, so pasting it into a site that sends it to a server is a real risk. UsefulTab's JWT Decoder decodes entirely in your browser — the token is never transmitted.

Why is my token's expiry a big number?

The exp (and iat) claims are Unix timestamps — seconds since 1 January 1970 UTC. The decoder shows the raw value; convert it to a readable date with a timestamp converter if you need the calendar time.