How to Read a JWT (JSON Web Token)

The three parts

A JWT is three Base64url-encoded sections joined by dots: header.payload.signature. The header says which algorithm signed it; the payload carries the claims (who you are, when the token expires); the signature proves the first two parts were not tampered with.

Decoding the payload

The header and payload are just Base64url-encoded JSON — decode them and you get plain, readable data. Common claims include sub (the subject or user id), exp (an expiry timestamp), and iat (issued-at). The JWT Decoder here splits and decodes a token entirely in your browser.

It is signed, not encrypted

This is the single most important thing to understand: a standard JWT is readable by anyone who has it. The signature stops it being altered, but it does not hide the contents. So never put passwords, card numbers or other secrets in a JWT payload — treat everything in it as public.

Why the signature matters

The server creates the signature with a secret key. When the token comes back, the server recomputes the signature and checks it matches. If someone edits the payload — say, to claim admin rights — the signature no longer matches and the token is rejected. This is why you must always verify the signature on the server, not just decode the token.

Frequently asked questions

Can I trust what is in a JWT? Only after verifying the signature; decoding alone proves nothing about authenticity.

Why is my token so long? It carries JSON claims plus a signature, all Base64-encoded — that adds up.

Should secrets go in a JWT? Never — the payload is readable by anyone holding the token.