How to Decode a JWT Token Online Without a Server

Back to Base64 Encode Decode Tool

JWT (JSON Web Tokens) are everywhere in modern web development - used for authentication, API authorization, and secure information exchange. If you have ever needed to inspect a JWT token to see what data it contains, this guide will show you how to decode it safely, entirely in your browser.

What is a JWT Token?

A JWT token is a compact, URL-safe string that consists of three parts separated by dots:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNqPZAmYgCgP

The three parts are:

1. Header (first segment) - Contains the signing algorithm and token type
2. Payload (second segment) - Contains the claims (data) like user ID, expiration, etc.
3. Signature (third segment) - Verifies the token has not been tampered with

Each segment is Base64URL-encoded. This means you can decode the header and payload without any server - they are just Base64URL-encoded JSON.

Why Decode Without a Server?

Many online JWT decoders send your token to their server for decoding. This is a security risk because JWT tokens often contain sensitive information like user IDs, email addresses, or session tokens. By decoding locally in your browser, your token never leaves your computer.

Our Base64 Encode Decode tool supports Base64URL mode - perfect for inspecting JWT tokens safely.

Step-by-Step: Decode a JWT Manually

Step 1: Get the Token

For this example, let us use a sample JWT:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Step 2: Split the Token

Split by the dot (.) separator:

• Header: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
• Payload: eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ
• Signature: SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Step 3: Decode Each Segment

Using the Base64 tool in Base64URL mode, decode each segment:

Header (decoded):

{"alg":"HS256","typ":"JWT"}

Payload (decoded):

{"sub":"1234567890","name":"John Doe","iat":1516239022}

The signature cannot be decoded as JSON - it is raw binary data that verifies token integrity.

Using Our Tool to Decode JWT

Our Base64 tool supports Base64URL mode specifically for JWT inspection:

1. Open the Base64 Encode Decode tool
2. Click the "Base64URL (JWT-safe)" pill at the top
3. Switch to "Decode" mode
4. Paste the JWT segment (header or payload)
5. Click "Convert" to see the decoded JSON

Using JavaScript to Decode JWT

function decodeJWT(token){
    var parts = token.split('.');
    if(parts.length !== 3){
        throw new Error('Invalid JWT: expected 3 segments');
    }

    // Decode header (first segment)
    var header = JSON.parse(atob(parts[0]
        .replace(/-/g, '+').replace(/_/g, '/')
        .padEnd(parts[0].length + (4 - parts[0].length % 4) % 4, '=')));
    console.log('Header:', header);

    // Decode payload (second segment)
    var payload = JSON.parse(atob(parts[1]
        .replace(/-/g, '+').replace(/_/g, '/')
        .padEnd(parts[1].length + (4 - parts[1].length % 4) % 4, '=')));
    console.log('Payload:', payload);

    return { header: header, payload: payload };
}

// Usage
var token = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
var decoded = decodeJWT(token);
// Header: { alg: "HS256", typ: "JWT" }
// Payload: { sub: "1234567890", name: "John Doe", iat: 1516239022 }

Understanding JWT Claims

JWT payloads contain claims. Some standard claims include:

• sub (Subject) - The user or entity the token is about
• iss (Issuer) - Who issued the token
• aud (Audience) - Who the token is intended for
• exp (Expiration) - When the token expires (Unix timestamp)
• iat (Issued At) - When the token was issued
• nbf (Not Before) - Token is not valid before this time
• jti (JWT ID) - Unique identifier for the token

Security Warning

Important: Decoding a JWT reveals the header and payload, but it does not verify the signature. Anyone can decode a JWT - the security comes from the signature, which proves the token was issued by a trusted party and has not been modified. Always verify the signature on your server using the secret key.

Never paste production JWT tokens into untrusted websites that might send your token to a remote server. Always use tools that process data locally, like devb64.com.

Common JWT Algorithms

• HS256: HMAC with SHA-256 (symmetric - same key signs and verifies)
• RS256: RSA with SHA-256 (asymmetric - private key signs, public key verifies)
• ES256: ECDSA with P-256 and SHA-256
• none: No signature (avoid this - it means anyone can forge tokens)

Try decoding JWT tokens yourself with our Base64 Encode Decode tool using Base64URL mode.