What Is a JWT? How to Decode and Read a JSON Web Token

Developer · Updated 1 Aug 2026 · 3 min read

If you build or debug web apps, you've seen long strings that look like random gibberish with two dots in them. That's a JWT - a JSON Web Token - and it's the backbone of authentication in countless modern APIs and single-sign-on systems. Here's what it is and how to read one.

What a JWT is for

A JWT is a compact, self-contained way to carry information between two parties - most often, proof that a user has logged in. After you sign in, the server hands your app a token; your app sends it back with each request, and the server trusts it because it's signed. No need to look the session up in a database every time.

The three parts

A JWT is three Base64URL-encoded sections separated by dots (header.payload.signature):

Header - says it's a JWT and which signing algorithm was used (e.g. HS256).
Payload - the "claims": data such as the user ID (sub), who issued it (iss), and when it expires (exp).
Signature - a cryptographic signature of the header and payload, created with a secret key, that proves the token hasn't been tampered with.

How to decode a JWT

Decoding just means Base64-decoding the header and payload to read what's inside - you don't need the secret for that. Paste a token into the JWT Decoder and it instantly shows the header and payload in readable JSON, along with the expiry. It runs entirely in your browser, so the token isn't sent anywhere.

The one thing everyone must understand

A JWT payload is only encoded, not encrypted. Anyone who has the token can read its contents. So never put passwords, secrets, or sensitive personal data in a JWT payload - treat it as public.

Decoding vs verifying

Reading a token (decoding) is not the same as trusting it (verifying). Verification checks the signature against the secret or public key, which only your server can do - that's what proves the token is genuine and unaltered. A decoder shows you the claims; it does not confirm the token is valid. Always verify on the server before acting on a token.

Good practices

Keep tokens short-lived with a sensible exp, and use refresh tokens for longer sessions.
Only inspect tokens you own or are authorised to handle.
Store tokens carefully on the client, and always send them over HTTPS.

For related encoding tasks, the Base64 Encoder and JSON Formatter are handy companions.

Try the tool

Put this guide into practice with our free JWT Decoder.

JWT Decoder

Frequently Asked Questions

Is a JWT encrypted?

No. The header and payload are only Base64URL-encoded, so anyone with the token can read them. The signature verifies integrity but does not hide the contents.

What is the difference between decoding and verifying a JWT?

Decoding reads the claims without the secret; verifying checks the signature against the secret or public key to confirm the token is genuine. Only verification proves a token can be trusted.

Is it safe to paste a JWT into an online decoder?

With the JWT Decoder here, decoding happens in your browser and the token is not sent anywhere. As a rule, only inspect tokens you are authorised to handle.