JWT Decoder: How to Read and Debug a JSON Web Token

JSON Web Tokens show up constantly in web development — as the token stored after logging into a site, or passed between services to prove a request is authenticated. A JWT looks like a long string of random characters, but it is actually three separate pieces of readable data joined together, and decoding it is straightforward once you know the structure.

This guide breaks down what those three pieces are, how to decode them, and a distinction that trips up a lot of people new to JWTs: decoding a token and verifying a token are not the same thing.

The three parts of a JWT

A JWT consists of three Base64-encoded sections separated by dots: header.payload.signature. The header typically specifies the token type and the signing algorithm used. The payload contains the actual claims — data like a user ID, an expiry time, or permission scopes. The signature is a cryptographic value used to verify the token has not been tampered with.

Both the header and payload are just standard Base64-encoded JSON, which is why they can be decoded instantly by anyone — there is no encryption involved in those two parts.

Decoding vs verifying: a crucial difference

Because the header and payload are only encoded, not encrypted, decoding a JWT and reading its contents requires no secret key at all — anyone holding the token can see exactly what claims it contains. This is why a JWT should never contain sensitive information like a password, since it is effectively readable by anyone who obtains the token.

Verifying a JWT is a completely different operation: it means checking the signature against the secret key (or public key, depending on the algorithm) that only the issuing server should have. A tool that decodes a JWT lets you inspect its contents, but it cannot tell you whether the token is legitimate — that check only happens on the server that issued it, using the secret it kept private.

Common fields found in a JWT payload

• "sub" — the subject, typically identifying the user the token belongs to.
• "exp" — the expiry timestamp, after which the token should no longer be accepted.
• "iat" — the issued-at timestamp, showing when the token was created.
• "iss" — the issuer, identifying which service created the token.
• Custom claims — application-specific data like roles or permissions, added by whoever issues the token.

Quick answer

What are the three parts of a JWT? A JWT consists of a header, a payload and a signature, joined together with dots, in the format header.payload.signature. In short, the JWT Decoder lets you handle jwt decoder for free, directly in your browser, with your files staying private on your own device the entire time.

Common use cases

People turn to jwt decoder for all sorts of everyday reasons. If any of these sound familiar, the JWT Decoder is built for exactly your situation:

• Knocking out a small, recurring digital task without breaking your flow.
• Getting professional-looking output without expensive software.
• Protecting your privacy and security across the tools you use daily.
• Working smoothly on any device, including locked-down or borrowed machines.
• Replacing several scattered websites with one trusted, private toolkit.

Whatever brought you here, the process is the same — quick, free and handled entirely on your own device — so you can get the result you need and move on.

Free ConvertProKit tools for this workflow

Everything in this guide is powered by free tools that run entirely in your browser — nothing is uploaded, there is no signup, and there are no watermarks or limits. These are the ConvertProKit tools that work best alongside the JWT Decoder for jwt decoder:

• JWT Decoder — get the job done free in your browser.
• Base64 Encoder / Decoder — encode and decode Base64 data both ways.
• Hash Generator — generate MD5, SHA and other hashes from any text.

Because each one processes files on your own device, you can chain them together — for example convert, then resize, then compress — without a single file ever leaving your computer. That combination of speed and privacy is the whole point of a browser-based toolkit: there is no upload to wait for, no queue, and no server holding a copy of your data afterward.

All of these tools are part of the wider ConvertProKit collection of free online utilities, so once you are set up for jwt decoder you have dozens of related image, PDF, text and productivity tools a click away — every one of them free, private and instant, with nothing to install and no account to create.

Tips to get the best results

A few habits make jwt decoder smoother and keep your results consistently high quality. Keep these in mind whenever you use the JWT Decoder:

• Bookmark one trusted, privacy-first toolkit so you never have to gamble on an unknown site mid-task.
• Favour tools that need no signup or install — they are faster to reach and work on any device.
• Keep sensitive data on your own device by choosing tools that process everything in your browser.
• Build small, repeatable habits around these tools so the routine tasks stop eating your time.

None of these take extra effort once they become routine, and together they are the difference between a result that is merely acceptable and one that is genuinely polished.

Common mistakes to avoid

Most problems with jwt decoder come down to a handful of avoidable slip-ups. Steer clear of these and you will get a clean result the first time:

• Trusting a different unknown website with your files for every small task.
• Reusing weak or identical passwords instead of generating strong, unique ones.
• Uploading company or personal data to tools that process it on a server.
• Reaching for heavyweight software when a quick browser tool would do.

The good news is that every one of these is easy to sidestep once you are aware of it. Take a moment to work from a good original, choose the right settings, and use a tool that keeps your files on your device, and the whole process becomes reliable rather than hit-or-miss. If something does not look right, it usually costs only a few seconds to adjust a setting and run it again — another advantage of doing everything instantly in your browser rather than waiting on a server round-trip.

Is it free and private?

Yes on both counts. The JWT Decoder is completely free — no account, no subscription, no watermark and no cap on how many times you can use it. More importantly, it is private by design: the work happens inside your browser using your own device, so your files are never uploaded to a remote server. When you close the tab, nothing is left behind anywhere but on your own machine, which is exactly what you want when jwt decoder involves anything personal or confidential.

This is a genuinely different model from most "free" online tools, which upload your file to their servers, process it there, and ask you to trust that they delete it afterward. With a browser-based tool there is nothing to trust and nothing to delete, because your data never travelled anywhere in the first place. That is why ConvertProKit can offer these tools free forever without limits — there is no per-file server cost to recover — and why you can use them with sensitive documents and personal photos without a second thought.

Frequently asked questions

The bottom line

A JWT is transparent by design — its header and payload are readable by anyone with the token, with no secret required. That is exactly why decoding a token is useful for debugging, but it is not the same as verifying one: only the server holding the signing secret can confirm a token is genuine.