JWT Tokens: How to Decode and Inspect Payloads

JSON Web Tokens (JWT) are used for authentication and information exchange. A JWT looks like three Base64url-encoded strings separated by dots: header.payload.signature.

Structure of a JWT: - Header: Contains the token type (JWT) and signing algorithm (e.g., HS256, RS256). Example: {"alg": "HS256", "typ": "JWT"} - Payload: Contains the claims — user ID, expiration time, issuer, and custom data. Example: {"sub": "123", "name": "John", "iat": 1516239022, "exp": 1516242622} - Signature: Created by signing the header and payload with a secret key. Used to verify the token has not been tampered with.

How to decode a JWT payload: 1. Split the token by dots and take the middle segment (the payload) 2. Convert Base64url to standard Base64: replace - with + and _ with / 3. Add padding if needed (length must be a multiple of 4) 4. Decode using Tooler's Base64 tool 5. You will get readable JSON with the token's claims

Important security note: Decoding a JWT only reads the payload — anyone can do it. The security of JWT comes from the signature, which proves the token was issued by a trusted authority and has not been modified. Never trust the payload of an unsigned or unverified JWT.

Common claims: - sub (subject): The user ID - iat (issued at): When the token was created - exp (expiration): When the token expires (Unix timestamp) - iss (issuer): Who issued the token - aud (audience): Who the token is intended for

Use Tooler's Base64 tool to decode JWT payloads for inspection and debugging.