JWT Decoder Explained: How to Safely Inspect a JSON Web Token
What's actually inside a JWT, why you can read the payload without a secret key, and why decoding a token is not the same as verifying it.
TCTechToolsCenter TeamIf you've ever pasted an access token into a debugger just to see what's actually inside it, you've already used the core idea behind a JWT Decoder. Here's what's really going on when you decode one, and an important distinction that trips people up: decoding isn't the same as verifying.
What a JWT actually looks like
A JSON Web Token is three Base64URL-encoded parts joined by dots: `header.payload.signature`. The header names the algorithm and token type, the payload holds the actual claims (user ID, expiry, roles, whatever the issuer put in), and the signature proves the token wasn't tampered with — assuming you have the secret or public key to check it.
Sponsored
Why you can read a JWT without any secret key
The header and payload are only encoded, not encrypted. Base64URL is a reversible encoding, not a cipher — anyone can decode those two parts and read the claims in plain text, no key required. That's a deliberate design choice, not a security hole: JWTs are meant to be inspectable. The signature is what actually protects the token from being modified, and checking that signature is a separate step from decoding.
Step-by-step: decode a token
- Copy the full JWT string (all three dot-separated parts).
- Paste it into a JWT Decoder.
- The tool splits it on the dots and Base64URL-decodes the header and payload back into readable JSON.
- Check the claims you actually care about — `exp` (expiry), `iat` (issued at), `sub` (subject/user ID), or any custom claims your app added.
Practical uses for developers
- Debugging why a user got logged out early — check the `exp` claim against the current time.
- Confirming an API actually issued the roles/permissions your app expects to see in the payload.
- Sanity-checking a token during integration work, without needing backend logs.
A security note
Never paste a *live, sensitive* production token — especially one tied to a real user session — into any third-party tool you don't fully trust, even a client-side one. For debugging, use a test/staging token wherever possible, since anyone who gets hold of a valid JWT before it expires can potentially use it as-is.
Tools used in this article
Sponsored
Frequently asked questions
Yes — the header and payload are Base64URL-encoded, not encrypted, so anyone can decode and read them. Only verifying the signature requires the secret or public key.
TechToolsCenter Team
Product & Tools
The team behind TechToolsCenter — building fast, private, browser-based tools and writing practical guides on how to get the most out of them.
Related articles
What Is a Password Manager, and Do You Actually Need One?
Reusing passwords across accounts is what makes a single breach dangerous everywhere else. Here's how a password manager's encrypted vault actually works, and what to plan for before you need it.
What Is Kubernetes? Container Orchestration Explained for Beginners
Docker runs one container reliably. Kubernetes is the layer that manages hundreds of them across a cluster — scheduling, scaling and healing them automatically. Here's how it actually works.
What Is Docker? Containers Explained for Beginners
"Works on my machine" is exactly the problem Docker exists to eliminate. Here's what containers actually are, core concepts explained simply, and a real Dockerfile walked through line by line.