How to decode a JWT (JSON Web Token)
A JWT — JSON Web Token — is a compact, URL-safe way to pass signed information between two parties. Decoding one simply means reading its contents, which are not encrypted.
The three parts of a JWT
Every JWT has three Base64URL-encoded parts separated by dots: the header, the payload and the signature. The header names the signing algorithm, the payload holds the claims (who the token is for, when it expires), and the signature lets the receiver verify nothing was tampered with.
The header and payload are only encoded, not encrypted. Anyone holding the token can read them, which is why you should never put passwords or secrets inside a JWT payload.
How to decode a JWT with FreetoolsY
Paste the token into the JWT Decoder. It splits the three parts, Base64URL-decodes the header and payload and prints them as readable JSON. The decoding runs entirely in your browser — the token is never uploaded to a server.
- Paste the full token (all three dot-separated parts).
- Read the alg value in the header and the claims (iss, sub, exp) in the payload.
- Check the exp claim to see exactly when the token expires.
Decoding is not verifying
Decoding shows you what a token claims; it does not prove the token is genuine. Always verify the signature on the server with the correct secret or public key before trusting a JWT. A decoded payload can be forged just as easily as any other JSON.
If you need to inspect the Base64 parts by hand, the Base64 Encoder/Decoder is handy, and the Json Formatter will pretty-print the decoded payload for easier reading.