Skip to content
GigAI Tools
6 steps

How to Decode a JWT (Read Its Header & Payload)

Paste a JSON Web Token and read its header and claims in plain JSON, inspect the algorithm, expiry and scopes while debugging auth. A safe, browser-only guide.

A JSON Web Token (JWT) is three Base64URL-encoded parts separated by dots: a header, a payload of claims, and a signature. It looks like random text, but the first two parts are just encoded JSON, not encrypted, so anyone can decode and read them. That's exactly what you do when debugging why a token is rejected, expired or missing a scope.

Decoding a JWT means reversing that Base64URL encoding to reveal the header (which algorithm signed it) and the payload (who it's for, when it expires, what it can do). This guide shows how, using our JWT decoder that runs entirely in your browser: your token is never sent anywhere, so it's safe to inspect real access tokens.

This guide uses JWT Decoder

Free, private and instant. Open it now and follow along with the steps below.

Open JWT Decoder

Follow these steps

  1. Step 1: Open the JWT decoder

    Go to the JWT decoder tool. It runs entirely in your browser, so nothing you paste is uploaded, logged or stored.

  2. Step 2: Paste your token

    Copy the full token (the long string in the form xxxxx.yyyyy.zzzzz) and paste it in. Include all three segments and both dots so it decodes correctly.

  3. Step 3: Read the decoded header

    The header decodes to JSON showing the signing algorithm (alg, e.g. HS256 or RS256) and the token type (typ). This tells you how the signature was produced and how it should be verified.

  4. Step 4: Inspect the payload claims

    The payload reveals the claims, sub (subject/user), iss (issuer), aud (audience), scopes or roles, plus timestamps. This is where you find who the token represents and what it's allowed to do.

  5. Step 5: Check the expiry and timing claims

    Look at exp (expiry), iat (issued-at) and nbf (not-before), which are Unix timestamps. If exp is in the past, the token is expired: the most common reason an otherwise valid token is rejected.

  6. Step 6: Note the signature (but verify separately)

    The third segment is the signature. Decoding doesn't verify it. Proving the token is authentic and untampered requires the signing secret or public key, which you'd check server-side, not in a decoder.

Tips & best practices

  • A JWT is encoded, not encrypted. Never put anything secret in the payload, because anyone holding the token can read every claim.
  • The exp, iat and nbf claims are Unix timestamps in seconds. Convert them to a readable date to confirm whether a token is currently valid.
  • Decoding tells you what a token says. It does not tell you the token is genuine. Only signature verification with the correct key proves authenticity.
  • If a valid-looking token is rejected, check exp first, then aud and iss. A mismatched audience or issuer is a frequent cause.

Related tools

Base64 Decoder

Decode Base64 back to text or a file instantly: Unicode-safe, auto-detects URL-safe input, sniffs binary data and offers a download. Runs fully in your browser, nothing uploaded.

Developer Studio

Base64 Encoder

Encode text or any file to Base64 instantly: Unicode-safe, with a URL-safe toggle and one-click data URLs. Runs entirely in your browser, nothing uploaded.

Developer Studio

JSON Formatter

Format, validate and minify JSON in your browser with pinpoint error line + column, jump-to-error, key sorting and live editing: nothing is uploaded.

Developer Studio

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-384 and SHA-512 checksums of any text or file at once, generate HMAC signatures with your own key, and verify a download against its expected hash, all in your browser, nothing uploaded.

Developer Studio

Related how-to guides

Frequently asked questions