개발자·4 분 분량·2026년 10월 16일

How to Decode a JWT Token (and What It Does Not Tell You)

Read the header, payload and expiry of a JSON Web Token in your browser. Learn what a JWT contains and why decoding is not the same as verifying.

What is inside a JWT

A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON that has been Base64URL-encoded, which is why a token usually starts with "eyJ". The payload holds claims such as the subject, the issuer and an expiry time.

How to decode one

Open the JWT Decoder and paste the token. The header and payload appear as readable JSON straight away, with no button to press. If the payload has an exp claim, the tool tells you whether the token has already expired or when it will, in your local time. Decoding happens in your browser, so the token is not sent anywhere.

Common reasons decoding fails

Paste only the token itself. A copied Authorization header such as "Bearer eyJ..." will not decode until you remove the word Bearer and the space. Encrypted tokens (JWE) have five parts and cannot be read this way.

Decoding is not verifying

The payload is encoded, not encrypted, so anyone who holds the token can read it and you should never put secrets in it. This tool does not check the signature, so a decoded token is not proof that it is genuine. Verification has to happen on your server with the right key.

도구 열기: JWT 디코더