What Is a JWT? How to Decode One (Free, No Signup)

What a JSON Web Token actually contains, how to decode one, and why decoding is not the same as verifying it.

What a JWT actually is

A JSON Web Token is three Base64URL-encoded pieces joined by dots: header.payload.signature. The header names the signing algorithm, the payload carries claims (data about the user or session, like sub, exp, or custom fields), and the signature lets the server that issued the token confirm it has not been tampered with.

Decoding vs. verifying — the distinction that trips people up

Decoding a JWT just reverses the Base64URL encoding to read the header and payload as plain JSON — anyone can do this, with no secret required, because a JWT is signed, not encrypted. Verifying a JWT is different: it checks the signature against the secret or public key that issued the token, which proves the payload has not been altered. A decoder shows you what a token contains; it cannot tell you whether that token is genuine.

• Decoding: reversible, needs no secret, anyone can read the payload
• Verifying: needs the signing key, confirms the token is authentic and unmodified

Why this matters for security

Because the payload is only encoded, never encrypted, never put sensitive data — passwords, full card numbers, secrets — inside a JWT payload. Anyone who intercepts the token can read every claim inside it just by decoding it, exactly the way our tool does.

Common claims you will see

Most JWTs carry a handful of standard claims worth recognizing at a glance.

• sub — the subject the token represents (usually a user ID)
• iat — issued-at time, as a Unix timestamp
• exp — expiry time; once past, the token should be rejected
• iss / aud — who issued the token and who it is intended for

Decode one now

Paste any JWT into our free JWT Decoder to see its header and payload instantly — entirely in your browser, so the token itself never leaves your device.