How to Decode a JWT

JWT structure

A JSON Web Token in compact form commonly looks like three text segments separated by periods:

base64url(header).base64url(payload).signature

The first two segments are Base64URL-encoded JSON. The final segment protects integrity when the token is correctly signed and verified.

Header, payload, and signature

Header

The header identifies token metadata such as typ and the signing algorithm in alg. A verifier must restrict algorithms through trusted configuration rather than blindly accepting the header value.

Payload

The payload contains claims such as subject, issuer, audience, permissions, and times. It is readable and must not be treated as encrypted.

Signature

The signature is calculated over the encoded header and payload. It cannot be validated from the token alone; verification needs the expected algorithm and the correct trusted secret or public key.

How to decode a JWT

1. Use a synthetic, expired, or redacted token whenever possible.
2. Open the JWT Decoder.
3. Paste the compact token and select Decode JWT.
4. Review header and payload JSON separately.
5. Treat every displayed claim as untrusted until the token is verified by the application.

Orbilyra decodes locally and does not send the token to a server. It is intentionally decode-only and does not claim that the signature is valid.

How to read common JWT claims

• iss: the issuer that created the token.
• sub: the subject represented by the token.
• aud: the intended audience.
• exp: the expiration time.
• nbf: the earliest time the token should be accepted.
• iat: the issued-at time.
• jti: an identifier for the token.

The three time claims are usually NumericDate values in Unix seconds. Convert them with the Unix Timestamp Converter or read the Unix timestamp guide.

Why decode does not mean verify

An attacker can create a different payload and Base64URL-encode it. Decoding will still produce readable JSON. Only a successful verification against trusted configuration establishes signature integrity, and the application must still enforce issuer, audience, expiration, permissions, and revocation policy.

The underlying segment encoding is explained in Base64 Encoding and Decoding Explained.

Safe JWT debugging

Do not paste active access tokens, refresh tokens, session tokens, secrets, or customer data into untrusted tools, chat systems, issue trackers, or screenshots. Prefer locally created examples and remove identifiers before sharing decoded content.