Home / JWT tools / JWT payload decoder

JWT Payload Decoder

Paste a token and read its payload as JSON, with the size of the data and any time claims shown as dates.

What is the JWT payload?

The payload is the middle part of a token. It is a JSON object that holds the claims: statements about the user, the issuer and the lifetime of the token. It is Base64URL encoded, which is a way to write text safely, not a way to hide it.

Anyone can read it

A signed JWT is not encrypted. Anyone who has the token can decode the payload, so it should never contain passwords, secrets or sensitive personal data. If the data must stay private, keep it on the server and put only an ID in the token.

What you see here

  • The payload as formatted JSON.
  • The number of claims, the size in bytes and the length of the Base64URL part.
  • A table of exp, nbf and iat as readable dates and as a time from now.

Keep payloads small

A token travels with every request, often in a header or a cookie. Large payloads slow requests down and can pass the size limits of servers and cookies. Keep only the claims you really need.

More tools

To see each claim explained, use the claims decoder. To build a payload with a calendar and presets, use the claims builder. For the whole token use the JWT decoder, and learn the basics in the JWT guide.

Frequently asked questions

How do I decode a JWT payload?

Take the text between the two dots, Base64URL decode it and parse the JSON. This tool shows the result directly.

Is the payload of a JWT secret?

No. It is encoded, not encrypted, so anyone with the token can read it.

What can go in a JWT payload?

Registered claims such as iss, sub, aud and exp, plus your own claims such as a role or a tenant ID.

How big can a JWT payload be?

There is no fixed limit, but tokens are sent with every request and cookies are limited to about 4 KB, so smaller is better.