How to Decode a JWT (And Why That's Not the Same as Verifying It)

A JWT arrives during API debugging — a long string of dot-separated characters — and you want to know what's actually inside it. Decoding one is trivial. Understanding what decoding does and doesn't prove is the part worth getting right, especially since the confusion here has real security implications.

What's Actually Inside a JWT

A JWT (JSON Web Token) has three dot-separated parts: a header, a payload, and a signature. The header and payload are both just Base64URL-encoded JSON — meaning anyone can decode them and read the contents with zero special access, no secret key required. That's by design; a JWT isn't meant to hide its contents (that's what encryption is for, a different and less common use case), it's meant to be tamper-evident — the signature is what would catch someone modifying the header or payload, if the signature were actually checked.

Decoding Is Not Verifying

This is the critical distinction: decoding reads the content, verifying confirms the signature is authentic. Anyone can construct a JWT with any header and payload they want and Base64URL-encode it themselves — that produces a token that decodes just as successfully as a real one issued by an actual authentication server. The only thing that separates a legitimate token from a fabricated one is whether its signature was produced with the correct secret or private key, and checking that requires the issuer's signing key — something a browser-side decoding tool never has and never asks for.

QR Ivify's JWT Decoder decodes only, and says so directly with a persistent warning: decoding a JWT does not verify its signature. It's built this way to avoid the much worse alternative — implying "valid" when all that's actually been confirmed is "well-formed."

Step by Step

1. Open the JWT Decoder.
2. Paste a JWT (three dot-separated parts) into the box.
3. Click "Decode."
4. Review the decoded header and payload, and the expiration/issued-at dates if the token includes them.

Reading the Standard Time Claims

Three standard claims, when present, get converted to human-readable dates automatically:

• iat (issued at) — when the token was created.
• exp (expiration) — when the token stops being valid, with a clear flag if that time has already passed.
• nbf (not before) — the earliest time the token is valid, for tokens issued in advance of when they should take effect.

These are just what the token claims about itself — again, nothing here confirms the token is genuine, only what it says.

Privacy, Specifically

Because JWTs frequently carry real user identity and session information, this matters more than for most text tools on this site: your token is never sent to a server, never logged to the browser console, and never written to local storage — it only exists in the page's memory for as long as you're actively using the tool.

Frequently Asked Questions

Does decoding verify that the token is valid or authentic? No. Decoding a JWT does not verify its signature — anyone can construct a token with any content. This tool only reads what's inside; it never claims the token is genuine.

Is my token uploaded, logged, or stored anywhere? No — the token is never sent to a server, never logged to the console, and never saved. It only exists in this page's memory while you're using it.

What does the expiration date mean? If the token has an exp claim, it's shown as a human-readable UTC date, along with whether that date has already passed — but this is just reading the claim, not proof the token was ever valid to begin with.

What if my token is malformed? You'll see "Invalid JWT format" rather than a broken or partial decode.

Can this verify the signature? No — signature verification requires the issuer's signing key, which this tool never has access to and never asks for.

Try It

Need to see what's actually inside a JWT during debugging? QR Ivify's free JWT Decoder reads the header and payload locally, with no logging or upload. Need to check a Base64 value that isn't a full JWT? See Base64 Decoder.