How to Decode a JWT and Read Its Claims

The three parts

A token looks like header.payload.signature. The header and payload are JSON encoded with Base64URL, which is Base64 with - instead of + and _ instead of /, and usually without = padding. The signature is binary data used for verification.

• Header: the signing algorithm (alg) and token type (typ), and sometimes a key ID (kid).
• Payload: the claims, such as the issuer, subject and expiry.
• Signature: proves the first two parts were not changed, if you check it.

Decode in JavaScript

function decodePart(part) {
  const b64 = part.replace(/-/g, "+").replace(/_/g, "/");
  const bytes = Uint8Array.from(atob(b64), c => c.charCodeAt(0));
  return JSON.parse(new TextDecoder().decode(bytes));   // handles UTF-8
}
const [h, p] = token.split(".");
console.log(decodePart(h), decodePart(p));

Decode in Python

import base64, json

def decode_part(part):
    padded = part + "=" * (-len(part) % 4)
    return json.loads(base64.urlsafe_b64decode(padded))

header, payload, _ = token.split(".")
print(decode_part(header), decode_part(payload))

Claims worth reading first

If a request fails with 401, check exp first. A token that expired seconds ago is the most common cause, and clock skew between servers can make it look expired early.

• exp: expiry time, in seconds since 1 January 1970 UTC. Convert it with a timestamp tool.
• iat: when the token was issued. nbf: not valid before this time.
• iss: who issued it. aud: who it is meant for. sub: the subject, often a user ID.
• jti: a unique token ID, useful for revocation lists.

Decoding is not verifying

Anyone can decode a token, and anyone can create one with any claims. Only a signature check with the correct key shows it is genuine. Verify on the server with a maintained library, require the algorithm you expect, reject the none algorithm, and check exp, iss and aud. Never make an authorization decision from a payload you only decoded.

Handle tokens like passwords

A valid access token works as a credential until it expires. Avoid pasting production tokens into tools you do not control. The JWT Decoder runs in your browser, but if a token has been exposed anywhere, revoke it and issue a new one.