How to Decode a JWT Header and Payload
For a three-segment compact JWT, split the token on dots and Base64URL-decode the first two segments as UTF-8 JSON. Those segments contain the header and payload. The remaining segment represents signature bytes. Reading them does not establish that the token came from a trusted issuer.
Use a synthetic token first
The example below is intentionally empty and has dummy signature bytes. It demonstrates the separators without including a live credential. Decode the first segment to an empty JSON object and repeat for the second. The final segment must not be interpreted as a third JSON document.
Use a local JWT library or decoder that explicitly supports Base64URL. Standard Base64 and Base64URL use different characters, so passing a whole token to a plain Base64 decoder is not equivalent. An encrypted token has a different structure and is outside this three-segment inspection workflow.
e30.e30.AA
Header: {}
Payload: {}
Signature: dummy bytes, not verifiedInspect a test token step by step
1. Obtain a non-sensitive test token from an environment you control. Remove any surrounding Bearer prefix before inspecting the compact token.
2. Read the header and payload separately. A readable algorithm name is only a claim from the token, not a trusted verification configuration.
3. When present, inspect issuer, audience and subject alongside the application's expectations. Numeric time claims use seconds; multiply by 1,000 for a JavaScript Date.
4. Check the authentication library's actual verification result in your application. Investigate a failure there instead of treating the decoder's readable output as authorization.
Do not confuse a readable payload with permission
A token can be altered and still decode successfully. A future expiry can also appear in an untrusted payload. The dedicated decode-versus-verify guide explains why a signature and claim checks belong in the application that accepts the token.
Bearer tokens may grant access even when their payload looks ordinary. Do not include a live token in a URL, screenshot or public issue. Local browser processing limits transfer by this tool but cannot protect against every browser extension or someone using the same device.
Follow along in Flekify
Open JWT Decoder to follow the segment example and examine header, payload and available timestamps. The verification warning remains relevant even when parsing succeeds.