How to Read a JWT (JSON Web Token)
JWTs are everywhere in modern authentication. They look like random gibberish, but they’re just encoded text you can read. Here’s how — and the security caveats.
The three parts
A JWT is three Base64URL-encoded sections joined by dots: header.payload.signature. The header says the algorithm, the payload holds the claims (like user id and expiry), and the signature proves it wasn’t tampered with.
Decoding it
The header and payload are only encoded, not encrypted, so anyone can read them. Paste a token into the JWT Decoder to see the header and payload as readable JSON — all in your browser, nothing uploaded.
The security caveat
Because the payload is readable and editable, never trust a JWT without verifying its signature on the server using the secret key. And never put passwords or secrets inside a token — treat the payload as public.
Related tools
Last updated: July 6, 2026