How to Decode a JWT: Header, Payload & Signature Explained

A JSON Web Token (JWT) looks like a random string, but it's really three Base64URL-encoded parts you can read in seconds. This post explains what's inside a JWT, how to decode it by hand, and — the part people get wrong — why decoding a token tells you nothing about whether it's valid. Want to skip the theory? Paste a token into our free JWT decoder and it breaks it apart instantly, all in your browser.

The three parts of a JWT

Every JWT has the shape header.payload.signature — three chunks separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0Iiwibm9uY2UiOjF9.SflKxw...

• Header — the algorithm and token type, e.g. {"alg":"HS256","typ":"JWT"}.
• Payload — the claims: who the token is about (sub), when it expires (exp), and any custom data.
• Signature — a cryptographic signature over the first two parts, used to detect tampering.

Decoding it yourself

The header and payload are just Base64URL-encoded JSON — not encrypted. Split on the dots and Base64-decode the first two parts. In the browser console:

const [h, p] = token.split(".");
console.log(JSON.parse(atob(h)));  // header
console.log(JSON.parse(atob(p)));  // payload

(For strictly correct Base64URL you'd swap -_ back to +/ first — our Base64 decoder handles the URL-safe variant for you.)

Decoding is not verifying

This is the crucial point: because the payload is only encoded, anyone can read and even rewrite it. What stops a forged token is the signature — and checking it requires the secret (for HS256) or the issuer's public key (for RS256). Never trust a claim like "role":"admin" just because you decoded it; your backend must verify the signature first. A decoder is a debugging tool, not an auth check.

Reading expiry and time claims

exp, iat and nbf are Unix timestamps (seconds). A token is expired when exp is in the past. Our JWT decoder converts these to human-readable dates and flags an expired token so you don't have to do the maths — and it can verify an HS256 signature locally if you paste the secret.

FAQ

Is it safe to paste a JWT into an online decoder?

It depends on the tool. Ours decodes entirely in your browser — the token never leaves your device or hits a server. Still, avoid pasting live production tokens into any tool you don't trust, and rotate anything you suspect is exposed.

Can I decode a JWT without a library?

Yes — it's just Base64URL-decoded JSON, as shown above. You only need a library (or the secret/public key) to verify the signature, not to read the contents.

What's the difference between HS256 and RS256?

HS256 signs with a shared secret; RS256 signs with a private key and is verified with the matching public key. The decoding steps are identical — only verification differs.