What is a JWT and what does decoding show?
Learn how a JSON Web Token is built, what its header and payload contain, and why decoding does not prove it is genuine.
Last updated 10 November 2026
How a JWT is built
A JSON Web Token has three parts separated by dots: a header, a payload and a signature. The header and payload are JSON objects encoded in Base64URL, so anyone who has the token can read them.
What decoding does not prove
Decoding only reads the header and payload. It does not show that the token is genuine. Only checking the signature with the correct secret or public key proves that, and that check must happen on the server that receives the token.
Reading the time claims
The exp claim is the expiry time, nbf is the earliest time the token is valid, and iat is when it was issued. All three are counted in seconds since 1 January 1970 UTC, so the decoder shows them as dates.
Keep live tokens private
A token can grant access to an account or an API, so treat it like a password. Do not paste live tokens into shared computers, chat messages or logs, and never paste a signing secret into any tool.
Try it with the JWT Decoder
Everything runs in your browser, and nothing you enter is uploaded.
Open JWT Decoder