How to Decode a JWT Token (and What It Does Not Tell You)
Read the header, payload and expiry of a JSON Web Token in your browser. Learn what a JWT contains and why decoding is not the same as verifying.
What is inside a JWT
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON that has been Base64URL-encoded, which is why a token usually starts with "eyJ". The payload holds claims such as the subject, the issuer and an expiry time.
How to decode one
Open the JWT Decoder and paste the token. The header and payload appear as readable JSON straight away, with no button to press. If the payload has an exp claim, the tool tells you whether the token has already expired or when it will, in your local time. Decoding happens in your browser, so the token is not sent anywhere.
Common reasons decoding fails
Paste only the token itself. A copied Authorization header such as "Bearer eyJ..." will not decode until you remove the word Bearer and the space. Encrypted tokens (JWE) have five parts and cannot be read this way.
Decoding is not verifying
The payload is encoded, not encrypted, so anyone who holds the token can read it and you should never put secrets in it. This tool does not check the signature, so a decoded token is not proof that it is genuine. Verification has to happen on your server with the right key.
Plus du blog
Qu'est-ce que Becoderr ? Plus de 120 outils en ligne gratuits au même endroit
Becoderr est une collection gratuite de plus de 145 outils en ligne pour PDF, images, JSON, texte, développeurs et tâches du quotidien : privé, rapide et sans inscription.
Comment compresser des images sans perdre en qualité
Réduisez la taille de vos images jusqu'à 90 % tout en gardant des photos nettes. Guide rapide pour compresser JPG et PNG en ligne, gratuitement et en privé.
Comment convertir un PDF en document Word modifiable
Transformez n'importe quel PDF en .docx modifiable dans Microsoft Word, gratuitement et sans inscription.