How to Decode a JWT – Step-by-Step Guide with Code Examples | JWT Secret Key Generator

Critical Distinction: Decoding is NOT Verification

Decoding merely transforms Base64URL bytes back into readable JSON. It proves NOTHING about whether the token was issued by a trusted server, whether it has been tampered with, or whether the signature is valid. Never trust claims in a decoded token without executing full cryptographic verification against your secret key.

warning Note

Decoding a JWT only reveals its contents. Anyone can forge a payload and re-encode it. Only cryptographic signature verification proves authenticity.

Decoding a JWT in Pure JavaScript

You can decode a JWT in any browser or Node.js environment without external dependencies:

javascriptPure JavaScript client-side JWT decoder function

function decodeJwtPayload(token) {
  const parts = token.split('.');
  if (parts.length !== 3) throw new Error('Invalid JWT format');
  
  // Base64URL to standard Base64:
  const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
  // Decode UTF-8:
  const json = decodeURIComponent(
    atob(base64)
      .split('')
      .map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
      .join('')
  );
  return JSON.parse(json);
}

Generate in Browser

Need a cryptographically secure JWT secret right now?

Generate 128 to 512-bit keys in Hex or Base64 using Web Crypto with zero server transmission.

Launch Generator

Frequently Asked Questions

Are JWT tokens encrypted by default?

No! Standard JWS (JSON Web Signature) tokens are signed, not encrypted. Their contents are public. If you need confidential payloads, you must use JWE (JSON Web Encryption).

Related Technical Guides

JWT Decoding

JWT Claims Explained: The Complete Reference for Standard and Custom Claims

Exhaustive developer guide to all 7 RFC 7519 registered JWT claims: syntax, formats, expiration math, and verification rules.

JWT Decoding

Understanding JWT Expiration: Clock Skew, Leeway, and Refresh Token Strategy

Master token expiration: how to handle server clock drift with leeway, setting optimal access token lifespans, and pairing with refresh tokens.