JSON guide · 7 min read
How to Decode a JWT Safely
Decode JWT headers and payloads, understand Base64URL encoding and remember that decoding does not verify authenticity.
The three JWT segments
A typical signed JWT contains a header, payload and signature separated by periods. The first two segments are Base64URL-encoded JSON; they are not encrypted by default.
Decoding is not verification
Anyone holding a token can usually decode its header and payload. Trust requires cryptographic signature verification using the correct key, expected algorithm and validation rules.
Claims to inspect
Applications must also apply clock-skew rules and domain-specific authorization checks.
- exp: expiration time.
- nbf: not-before time.
- iat: issued-at time.
- iss: issuer.
- aud: intended audience.
- sub: subject.
Handle tokens as secrets
JWTs may grant access even though their payload is readable. Avoid pasting production tokens into remote services, logs, tickets or chat messages. Prefer local decoding and redact sensitive claims.
Common questions
Frequently asked questions
Is JWT payload data encrypted?
Usually no. Standard signed JWT payloads are encoded and readable; encryption requires a separate JWE design.
Can a decoded JWT be trusted?
No. It must be cryptographically verified and its issuer, audience, expiration and other required claims must be checked.