JWT Decoder

JavaScript (Browser) — Manual Decode

// JWTs are Base64URL-encoded — no library needed to read claims
function decodeJwt(token) {
  const [header, payload] = token.split(".");
  const decode = (str) =>
    JSON.parse(atob(str.replace(/-/g, "+").replace(/_/g, "/")));
  return { header: decode(header), payload: decode(payload) };
}

const { header, payload } = decodeJwt("eyJhbGciOiJIUzI1NiJ9...");
console.log(payload.sub);  // user ID
console.log(payload.exp);  // expiry (Unix timestamp)
// ⚠️  This only reads claims — it does NOT verify the signature.

Node.js — jose (verify + decode)

// npm install jose
import { jwtVerify, decodeJwt } from "jose";

// Decode without verification (inspect claims only)
const claims = decodeJwt("eyJhbGciOiJIUzI1NiJ9...");
console.log(claims);

// Verify HS256 token
const secret = new TextEncoder().encode("your-secret-key");
const { payload } = await jwtVerify("eyJhbGciOiJIUzI1NiJ9...", secret);
console.log(payload.sub);

// Verify RS256 token using JWKS endpoint
import { createRemoteJWKSet } from "jose";
const JWKS = createRemoteJWKSet(new URL("https://auth.example.com/.well-known/jwks.json"));
const { payload: p } = await jwtVerify(token, JWKS);

Python — PyJWT

# pip install PyJWT cryptography
import jwt

# Decode without verification (inspect claims only)
claims = jwt.decode(token, options={"verify_signature": False})
print(claims)

# Verify HS256 token
claims = jwt.decode(token, key="your-secret-key", algorithms=["HS256"])
print(claims["sub"])

# Verify RS256 token
with open("public_key.pem") as f:
    public_key = f.read()
claims = jwt.decode(token, public_key, algorithms=["RS256"])

Go — golang-jwt

// go get github.com/golang-jwt/jwt/v5
import "github.com/golang-jwt/jwt/v5"

// Parse and verify HS256
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
    if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
        return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
    }
    return []byte("your-secret-key"), nil
})

if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
    fmt.Println(claims["sub"])
    fmt.Println(claims["exp"])
}

Terminal

# Decode payload (no verification) using base64 and jq
TOKEN="eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzEyMyIsImV4cCI6MTcwMDAwMDAwMH0.sig"
PAYLOAD=$(echo $TOKEN | cut -d. -f2)

# Add padding if needed and decode
echo "${PAYLOAD}==" | tr '_-' '/+' | base64 -d | jq .

# Output:
# { "sub": "user_123", "exp": 1700000000 }