How to decode a JWT
Decode a JSON Web Token to read its header and payload without the secret. Step-by-step, plus a free browser-side JWT decoder.
You can read the contents of any JWT without the signing key — the header and payload are just Base64URL-encoded JSON. Here is how to decode one safely and what each part means.
Decode in your browser, not on a server
A JWT often contains a live session. Decoding it on a remote server means handing that session to someone else. Always use a client-side decoder (ours decodes entirely in the browser) and never paste production tokens into untrusted sites.
Reading the result
The header tells you the signing algorithm; the payload holds the claims — sub, exp, iat and any custom data. The signature cannot be verified without the key, so a decoder will show the payload but mark the signature as unverified. Never trust a decoded payload as authenticated on its own.
Step by step
Copy the full token — three Base64URL parts separated by dots (header.payload.signature).
Open the JWT decoder and paste it in.
Read the header to see the algorithm (e.g. HS256), and the payload for claims like sub, exp and iat.
Convert the exp claim with the timestamp tool to see when the token expires.
Note the "signature unverified" warning — decoding never proves the token is authentic.
Try it now — free, no signup
Use the JWT decoder in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.