Critical Distinction: Decoding is NOT Verification
Decoding merely transforms Base64URL bytes back into readable JSON. It proves NOTHING about whether the token was issued by a trusted server, whether it has been tampered with, or whether the signature is valid. Never trust claims in a decoded token without executing full cryptographic verification against your secret key.
Decoding a JWT only reveals its contents. Anyone can forge a payload and re-encode it. Only cryptographic signature verification proves authenticity.
Decoding a JWT in Pure JavaScript
You can decode a JWT in any browser or Node.js environment without external dependencies:
Frequently Asked Questions
Are JWT tokens encrypted by default?
No! Standard JWS (JSON Web Signature) tokens are signed, not encrypted. Their contents are public. If you need confidential payloads, you must use JWE (JSON Web Encryption).