Coffe2CodeWhat is in a JWT
base64url(header) . base64url(payload) . base64url(signature)
- Header: the signing algorithm (
alg, such as HS256 or RS256) and the token type (typ). - Payload: the claims. Registered ones include
sub(subject, usually the user ID),iss(issuer),aud(audience),exp,iatandnbf. Anything else is a custom claim. - Signature: a hash of the first two parts, made with the secret (HMAC) or private key (RSA, ECDSA). Change one character of the payload and the signature no longer matches.
Read the full breakdown in JWT explained.
Decode a JWT in code
// Browser or Node: read the payload (does NOT verify)
const payload = JSON.parse(atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')));
// Node.js: verify with the jsonwebtoken package
import jwt from 'jsonwebtoken';
const claims = jwt.verify(token, process.env.JWT_SECRET); // throws if invalid or expiredFrequently asked questions
Is it safe to paste a JWT into an online decoder?
Only if the decoder runs in your browser. A JWT is a bearer token: anyone holding a valid one can use it until it expires. This decoder never sends the token anywhere, but as a rule, avoid pasting live production tokens into tools that do.
Does decoding a JWT verify it?
No. The header and payload are just Base64URL-encoded JSON, so anyone can read them. Verification means checking the signature with the secret or public key, which your server must do before trusting any claim in the token.
What do exp, iat and nbf mean?
They are registered claims holding Unix timestamps in seconds. exp is when the token expires, iat is when it was issued, and nbf (not before) is the earliest time it may be used. This decoder shows each one as a readable date.
Is the data in a JWT encrypted?
Not in a normal signed JWT (a JWS). The payload is readable by anyone. Do not put passwords or sensitive personal data in it. Encrypted tokens (JWE) exist and have five parts instead of three.