How to Decode a JWT Token (Header, Payload, Signature)

A JWT (JSON Web Token) is a compact, Base64URL-encoded string used to carry claims between two parties, most commonly for authentication in web APIs. A JWT has three parts — header.payload.signature — separated by dots, and the first two can be decoded to readable JSON without any secret. The NeatForge JWT Decoder decodes the header and payload locally in your browser and highlights time-based claims.

What Is a JWT?

A JWT encodes a JSON object (the “claims”) into a string that can be safely passed in URLs, headers or cookies. A typical token looks like:

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMTIzIiwiaWF0IjoxNzAwMDAwMDAwLCJleHAiOjE3MDAwODY0MDB9.s8vN...signature

JWTs are stateless: the server does not need to look up a session, because the claims travel inside the token itself.

The Three Parts of a JWT

• Header — describes the token type and signing algorithm (e.g. {"alg":"HS256","typ":"JWT"}).
• Payload — contains the claims, such as user ID, roles, and timestamps.
• Signature — used to verify that the token was not tampered with.

Only the header and payload can be decoded — the signature is not JSON and cannot be “decoded”, only verified.

The header and payload are encoded with Base64URL, a variant of Base64 that uses - instead of +, _ instead of /, and omits = padding so the string is safe in URLs. For a deeper look at that encoding, see our guide on how to encode and decode Base64.

What iat, nbf and exp Mean

These three registered claims are stored as Unix timestamps in seconds:

• iat (issued at) — when the token was created.
• nbf (not before) — the earliest time the token is valid.
• exp (expiration) — when the token stops being valid.

A token is active only when the current time is between nbf and exp. The decoder compares these timestamps to your browser’s clock and flags expired or not-yet-valid tokens in red or yellow.

Decode vs Verify — An Important Distinction

Decoding only reverses the Base64URL encoding so you can read the claims. Anyone can decode a JWT, and anyone can forge a token with arbitrary claims.

Verification checks the signature against the signing secret or public key to confirm the token was issued by a trusted party and has not been modified.

This tool decodes only. It does not verify the signature. Never trust a decoded token’s claims for access control without verifying it server-side first.

How to Decode a JWT Safely

1. Open the JWT Decoder.
2. Paste the token into the input box.
3. Review the pretty-printed header and payload JSON.
4. Check the color-coded status of iat, nbf and exp.

Privacy Note

Decoding happens entirely in your browser. Your token is never uploaded, logged, or stored. Even so, avoid pasting highly sensitive tokens into third-party sites, and never share JWTs in screenshots or support tickets — they may contain user IDs or scopes.

FAQ

Does this tool verify the JWT signature? No. It only decodes the token. Verification requires the signing secret or public key and must be done server-side.

What do iat, nbf and exp mean? iat is issued-at, nbf is not-before, and exp is expiration. All are Unix timestamps in seconds.

Is it safe to paste my JWT here? Yes — all decoding is local and nothing is sent to a server. However, you should still avoid pasting tokens into untrusted sites.

→ Open the free JWT Decoder