How to Decode a JWT and Read Its Claims

A JSON Web Token, or JWT, is a compact string that apps use to prove who you are. It often looks like three blocks of random letters joined by dots. Inside, it is just JSON that has been encoded.

The three parts

xxxxx.yyyyy.zzzzz
header.payload.signature

• Header: the token type and the signing algorithm, such as HS256 or RS256.
• Payload: the claims, which are facts about the user and the token.
• Signature: proof that the header and payload haven't been changed.

The header and payload are encoded with Base64URL, a web-safe version of Base64. Anyone can decode them. That is why you should never put secrets such as passwords in a JWT. The Base64 Encoder can decode a part by hand if you are curious.

Claims you will see often

• sub is the subject, usually a user ID.
• iss is the issuer, the service that created the token.
• aud is the audience the token is meant for.
• iat is the time it was issued.
• exp is the time it expires.
• nbf is the time before which it must not be accepted.

The time claims are Unix timestamps, counted in seconds. Paste them into the Unix Timestamp Converter to see a readable date.

Decoding isn't verifying

Reading a token only tells you what it says. To trust it, your server must check the signature with the right key, confirm the expiry time and check the issuer and audience. A decoder on a website can't do that without your secret, so never treat a decoded token as proof of anything.

Debugging with the decoder

Paste your token into the JWT Decoder to see the header, the claims and whether it has expired. It runs in your browser, so the token isn't sent anywhere. Even so, avoid pasting live production tokens into any tool you don't control.