Every time your application talks to an API that uses token-based auth, a JSON Web Token (JWT) travels with the request. On the surface it's an opaque string of letters, dots, and equals signs — but each token is really three independent segments that any developer can read in seconds once they know what to look for.
Anatomy of a JWT
A JWT is built from three dot-separated parts: the header, the payload, and the signature. Each part is base64url-encoded JSON, so decoding them is purely a matter of un-encoding the text — no secrets required for the first two segments.
- Header — describes how the token was signed, e.g. {"alg":"HS256","typ":"JWT"}.
- Payload — the claims: who the token is for (sub), the audience (aud), the issuer (iss), and when it expires (exp).
- Signature — a cryptographic digest that proves the token hasn't been tampered with.
Never trust the payload alone
Anyone can decode the payload — encoding is not encryption. Always verify the signature server-side with the correct secret or public key before trusting any claim.
Reading the claims you actually care about
In practice, the fields that matter day-to-day are the expiration time and the subject. exp is a Unix timestamp; if it's in the past, the token is expired. sub identifies the user, and aud tells you which audience the token was minted for — mismatches here are a common source of confusing 401s.
Instead of base64-decoding each segment by hand and converting Unix timestamps in your head, paste the token into ForgePlug's JWT Decoder. It splits the segments, renders the claims as readable JSON, and shows a live countdown of how much validity remains — including an expired-state warning the moment the token lapses.
Decode a token in one paste
Paste any JWT — including third-party tokens — and see header, payload, expiration, and signature instantly. Everything runs locally in your browser.
Open JWT DecoderCommon pitfalls
- Expired tokens — the exp claim passed, but your client never refreshed. Check the countdown before debugging anything else.
- Malformed input — a token missing a segment, or with non-URL-safe characters, will fail to parse entirely.
- Wrong audience — the token is valid but was issued for a different aud, and the API rejects it.
Reading JWTs is a skill every backend and frontend developer hits eventually. Once you can decode a token in a single paste, debugging auth flows stops being guesswork.