How to Decode a JWT Token (and What It Does Not Tell You)
Read the header, payload and expiry of a JSON Web Token in your browser. Learn what a JWT contains and why decoding is not the same as verifying.
What is inside a JWT
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON that has been Base64URL-encoded, which is why a token usually starts with "eyJ". The payload holds claims such as the subject, the issuer and an expiry time.
How to decode one
Open the JWT Decoder and paste the token. The header and payload appear as readable JSON straight away, with no button to press. If the payload has an exp claim, the tool tells you whether the token has already expired or when it will, in your local time. Decoding happens in your browser, so the token is not sent anywhere.
Common reasons decoding fails
Paste only the token itself. A copied Authorization header such as "Bearer eyJ..." will not decode until you remove the word Bearer and the space. Encrypted tokens (JWE) have five parts and cannot be read this way.
Decoding is not verifying
The payload is encoded, not encrypted, so anyone who holds the token can read it and you should never put secrets in it. This tool does not check the signature, so a decoded token is not proof that it is genuine. Verification has to happen on your server with the right key.
More from the blog
What Is Becoderr? 145+ Free Online Tools in One Place
Becoderr is a free collection of 145+ online tools for PDFs, images, JSON, text, developers and everyday tasks — private, fast, and no sign-up.
How to Compress Images Without Losing Quality
Reduce image file size by up to 90% while keeping photos crisp. A quick guide to compressing JPG and PNG online, free and private.
How to Convert a PDF to an Editable Word Document
Turn any PDF into an editable .docx you can change in Microsoft Word, free and without sign-up.