What Is a JWT and How Do You Decode One?

If you've worked with modern authentication systems, you've likely seen a long string starting with "eyJ" — that's a JWT (JSON Web Token). Here's what it actually is and how to inspect what's inside one.

What Is a JWT?

A JWT is a compact, self-contained way to securely transmit information between two parties, most commonly used for authentication. When you log into a website, the server often issues a JWT that your browser stores and sends with future requests to prove you're logged in — without the server needing to look up your session in a database every time.

The Three Parts of a JWT

A JWT consists of three parts separated by dots: header.payload.signature

Header: Specifies the token type and the signing algorithm used
Payload: Contains the actual data (called "claims") — like user ID, roles, or expiration time
Signature: Verifies the token hasn't been tampered with, created using a secret key only the server knows

Decoding vs. Verifying — An Important Difference

⚠️ Important: Decoding a JWT just reads its contents — it does NOT verify the token is authentic. The header and payload are only Base64-encoded, not encrypted, so anyone can decode and read them. Only the signature (which requires the secret key) proves the token is genuine and unmodified.

This means you should never trust the contents of a JWT without verifying its signature server-side. Decoding is useful for debugging and inspection — not for security decisions.

Decode any JWT instantly and inspect its header and payload.

🔑 Try the Free JWT Decoder

Common Uses for a JWT Decoder

Debugging authentication issues: Checking what claims are actually inside a token
Checking token expiration: Verifying the "exp" claim to see when a token expires
API development: Inspecting tokens received from third-party services
Learning/education: Understanding how JWT-based authentication works under the hood

Our free JWT Decoder instantly decodes any token and displays its header and payload in readable format — right in your browser, with nothing sent to a server.