How to read a JWT (and what you should never do with one)

What's inside

The header names the signing algorithm (for example HS256 or RS256). The payload carries claims: who issued it (iss), who it is about (sub), who it is for (aud), when it was issued (iat) and when it expires (exp). The signature proves the first two parts have not been altered by someone without the key.

Decode it

The JWT Decoder splits the token and shows the header and payload as formatted JSON, with the timestamp claims converted to readable dates.

1. 1Open the JWT Decoder.
2. 2Paste the token — header.payload.signature.
3. 3Read the claims and check the expiry.

The safety rules

Decoding is not verifying. A decoder cannot tell you whether a token is genuine — that needs the secret or public key, which you should never paste into a website you do not control. Treat production tokens as passwords: they usually grant access on their own.

• •JWT Decoder — inspect the header and claims.
• •Base64 — decode an individual part by hand.