What Is a JWT? How to Read and Decode a JSON Web Token

If you've worked with an API or a login system, you've seen a JWT — a long string like eyJhbGci... that shows up in an Authorization: Bearer header. JWT stands for JSON Web Token, and once you know its shape it's easy to read.

The three parts

A JWT is three Base64URL-encoded sections joined by dots:

header.payload.signature

• Header — metadata: the token type and the signing algorithm (e.g. HS256, RS256).
• Payload — the claims: the actual data, such as the user id (sub), who issued it (iss), and when it expires (exp). These are just JSON.
• Signature — a cryptographic signature over the header and payload, created with a secret or private key.

Decoding is not the same as verifying

Here's the part that matters for security: the header and payload are only encoded, not encrypted. Anyone can Base64-decode them and read every claim — so never put secrets in a JWT payload.

The signature is what makes a JWT trustworthy. Decoding shows you the contents; verifying the signature against the issuer's key is what proves the token is authentic and unaltered. A server must always verify — reading the claims without checking the signature is how tokens get forged.

Reading expiry

The exp claim is a Unix timestamp (seconds since 1970). If it's in the past, the token is expired and should be rejected regardless of whether the signature is valid. iat (issued-at) and nbf (not-before) work the same way.

Inspect one safely

To read a token's header and payload, use the free JWT Decoder. It decodes entirely in your browser — the token never leaves your device, which matters because a real JWT is a live credential. Use it to debug auth flows, check what claims a token carries, and read its expiry.

Related developer & security tools

JWT Decoder | Base64 Encoder / Decoder | Hash Generator | All free tools