How to Decode a JWT and Read Its Claims
Decode JWT header and payload sections, understand common claims and avoid a common security mistake.
Related tool
Open tool
JWT Decoder & Token Inspector helps you apply this guide directly in the browser.
The three parts of a JWT
A typical JWT has a header, payload and signature separated by dots.
The header and payload are Base64URL-encoded JSON. Decoding them helps you inspect fields such as subject, issuer, audience and expiration.
Decoding is not verification
Decoding only reads the visible data. It does not prove the token is trusted or unchanged.
Signature verification requires the correct secret or public key and should happen in the application or authentication service.