How to Read a JWT Without Treating It as Verified
By Tools Star Hub Editorial Team · Published
A compact JWT is three Base64URL sections separated by dots: header, payload, and signature. This page decodes the header and the payload so you can read the JSON. It does not check the signature.
Anyone can change the payload and leave a signature in place. A decoded name or date is text from the token, not proof that a server signed it.
How to read a JWT
- Paste a token with two dots. One section is rejected. Four sections are rejected.
- Read the header JSON and the payload JSON. A header that is not JSON is rejected. Characters that are not valid Base64URL are rejected.
- Check the signature report. The page says whether a signature section is present and whether that section is empty. Decoding does not call the signature valid.
Example
A signed-looking sample
The sample token with header alg HS256 and payload name John Doe decodes that name and reports that a signature section is present.
An empty signature
A token whose third section is empty decodes the payload and reports an empty signature. A payload that contains café keeps the accented character.
FAQ
- Does decode mean the token is trusted?
- No. The signature is not checked.
- What is the middle section?
- The payload, as JSON.
- What if the signature is missing?
- An empty third section still decodes, and the page says the signature is empty.
- Why was the token rejected?
- It had the wrong number of sections, the header was not JSON, or the Base64URL was invalid.
To read a JWT header and payload without treating the signature as verified, use the JWT Decoder.