JWT Decoder

Learn about JWTs

What's actually inside a JWT

A JWT has three Base64URL-encoded parts separated by dots: a header (the algorithm and token type), a payload (the actual claims, like a user ID, an expiry time, or roles), and a signature (proof the token wasn't tampered with, for anyone holding the right key to verify it).

Reading your results

Decoding the header and payload just reveals what's already sitting there in plain view, since Base64 isn't encryption, it's just an encoding. Anyone can read a JWT's contents without a secret. The signature is the only part that actually requires a key, and that's what makes a token trustworthy, not the fact that it looks unreadable at a glance.

Common questions

Can I edit a decoded JWT and use it? Editing the payload and re-encoding it produces a token with an invalid signature, since you don't have the private or secret key that created the original. A server that actually verifies signatures will reject it. This tool decodes a token, it doesn't forge a valid one.

Why can I read my session token's contents without logging in anywhere? Because a JWT's header and payload are only Base64-encoded, not encrypted. That's by design, since JWTs are meant to be verified, not kept secret from whoever's holding them. Real secrets, like a password, should never go directly in a JWT payload.

What does "exp" in the payload mean? The expiry time, written as a Unix timestamp. After that point, the token is supposed to be treated as invalid by anything that checks it.