JWT Decoder for JavaScript (Browser)
Paste any JWT to decode it instantly — then use the pure JavaScript code examples below to implement JWT decoding in your frontend without any dependencies.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How to decode JWTs in vanilla JavaScript
JWT headers and payloads are Base64Url-encoded, which is almost identical to standard Base64 but replaces + with - and / with _ and removes padding (=). Modern browsers provide the atob() function for Base64 decoding. Combined with a small Base64Url-to-Base64 replacement and JSON.parse(), you can decode any JWT header or payload in just a few lines of vanilla JavaScript with zero dependencies.
For signature verification in the browser, the Web Crypto API (window.crypto.subtle) provides SubtleCrypto.verify() with support for HMAC-SHA256 (HS256), RSA-SHA256 (RS256), ECDSA P-256 (ES256), and more. This is exactly what the decoder above uses — all verification runs client-side in your browser using these same native APIs.
Never do JWT verification purely on the client side for security-sensitive operations — an attacker controlling the client can bypass or forge client-side checks. Always verify tokens server-side before granting access to protected resources. Use client-side decoding only to read claims for UI purposes (like displaying the user's name).
JavaScript — no library needed
javascript// Base64Url decode helper
function b64urlDecode(str) {
const b64 = str.replace(/-/g, '+').replace(/_/g, '/')
return JSON.parse(atob(b64.padEnd(
b64.length + (4 - b64.length % 4) % 4, '='
)))
}
// Decode a JWT (no verification)
function decodeJWT(token) {
const [header, payload, signature] = token.split('.')
return {
header: b64urlDecode(header),
payload: b64urlDecode(payload),
signature,
}
}
const { header, payload } = decodeJWT(token)
console.log(header) // { alg: 'RS256', typ: 'JWT' }
console.log(payload) // { sub: '...', exp: 1720000000 }
// Check expiry
const isExpired = payload.exp * 1000 < Date.now()
console.log('Expired:', isExpired)How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.