How to Read Base64 Data and JWT Tokens
Distinguish encoding from encryption and inspect JWT header and payload data without assuming signature validity.
Base64 is an encoding, not protection
Base64 represents bytes using printable characters. Anyone who has the value can decode it. It is useful in data formats, email transport, and tokens, but it should not be used to hide passwords or confidential information.
How a JWT is arranged
A typical JSON Web Token has three dot-separated sections: a Base64url-encoded header, a Base64url-encoded payload, and a signature. Decoding the first two reveals claims such as issuer, audience, subject, and expiry. It does not prove that the signature is valid.
Inspect a token safely
- Use a token from a development or controlled environment when possible.
- Decode it and check algorithm, issuer, audience, issued-at, not-before, and expiry claims.
- Validate the signature and claims inside the application using an approved library and trusted key configuration.
- Never paste production bearer tokens into services you do not control.
Common errors
Standard Base64 and Base64url use slightly different characters and padding rules. A malformed segment may fail to decode. Date claims are often Unix timestamps. Algorithm names in an unverified header are attacker-controlled input and must not choose an unsafe verification path.