# What Is a JWT? How to Read and Decode a JSON Web Token

> A JWT is three Base64 chunks separated by dots — a header, a payload of claims, and a signature. Here's how to read one, what each part means, and why decoding is not the same as trusting.

- URL: https://www.pyalm.com/blog/what-is-a-jwt-decode-json-web-token
- Author: Fadhil Abdulla
- Category: Free Tools
- Published: 2026-07-07
- Updated: 2026-07-07

---

If you've worked with an API or a login system, you've seen a **JWT** — a long string like `eyJhbGci...` that shows up in an `Authorization: Bearer` header. JWT stands for **JSON Web Token**, and once you know its shape it's easy to read.

## The three parts

A JWT is three Base64URL-encoded sections joined by dots:

```
header.payload.signature
```

- **Header** — metadata: the token type and the signing algorithm (e.g. `HS256`, `RS256`).
- **Payload** — the **claims**: the actual data, such as the user id (`sub`), who issued it (`iss`), and when it expires (`exp`). These are just JSON.
- **Signature** — a cryptographic signature over the header and payload, created with a secret or private key.

## Decoding is not the same as verifying

Here's the part that matters for security: the header and payload are **only encoded, not encrypted**. Anyone can Base64-decode them and read every claim — so **never put secrets in a JWT payload.**

The signature is what makes a JWT trustworthy. Decoding shows you the contents; **verifying** the signature against the issuer's key is what proves the token is authentic and unaltered. A server must always verify — reading the claims without checking the signature is how tokens get forged.

## Reading expiry

The `exp` claim is a Unix timestamp (seconds since 1970). If it's in the past, the token is expired and should be rejected regardless of whether the signature is valid. `iat` (issued-at) and `nbf` (not-before) work the same way.

## Inspect one safely

To read a token's header and payload, use the free [JWT Decoder](https://www.pyalm.com/free-tools/jwt-decoder). It decodes entirely in your browser — the token never leaves your device, which matters because a real JWT is a live credential. Use it to debug auth flows, check what claims a token carries, and read its expiry.

## Related developer & security tools

[JWT Decoder](https://www.pyalm.com/free-tools/jwt-decoder) | [Base64 Encoder / Decoder](https://www.pyalm.com/free-tools/base64-encoder-decoder) | [Hash Generator](https://www.pyalm.com/free-tools/hash-generator) | [All free tools](https://www.pyalm.com/free-tools)