How to decode a JWT
A JWT is three Base64 parts. Here's how to decode one to inspect its claims — safely and without a library.
Steps
- Open the JWT decoder and paste your token.
- The header and payload are decoded and shown as readable JSON.
- Check claims like exp (expiry), iss (issuer) and sub (subject).
Decoding is not verifying
Decoding reveals what a token contains but does not verify its signature. Never trust an unverified token for authorization decisions — verification requires the signing key on your server.
Tools used in this guide
Related guides
How to decode a JWT — FAQ
Paste it into the JWT decoder — it shows the header and payload as JSON so you can inspect the claims.