How to Decode a JWT Token: Complete Guide (Without Code) 2026

If you've worked with modern web authentication, you've encountered a JWT (JSON Web Token) — that long string of characters starting with eyJ... sitting in your browser's localStorage or Authorization header. Decoding a JWT is essential for debugging authentication issues, inspecting user claims, checking expiration, and understanding what your auth server is actually returning. The good news: the first two parts of a JWT are just Base64-encoded JSON — no cryptography required to read them.

What Is a JWT?

A JSON Web Token (JWT, pronounced “jot”) is a compact, URL-safe way to represent claims between two parties. Defined in RFC 7519, JWTs are used primarily for:

JWT Structure: 3 Parts Separated by Dots

A JWT always has the format xxxxx.yyyyy.zzzzz — three Base64URL-encoded segments separated by periods:

{
  "alg": "HS256",   // Signing algorithm: HS256, RS256, ES256...
  "typ": "JWT"      // Token type (always "JWT")
}

{
  "sub": "1234567890",     // Subject (user ID)
  "name": "John Doe",      // Custom claim
  "email": "john@example.com",
  "roles": ["admin", "user"],
  "iat": 1516239022,       // Issued At (Unix timestamp)
  "exp": 1516325422,       // Expiration (Unix timestamp)
  "nbf": 1516239022        // Not Before (optional)
}

HMACSHA256(
  base64UrlEncode(header) + "." + base64UrlEncode(payload),
  secret_key  // Only the server knows this
)

How to Decode a JWT (3 Methods)

Method 1: Online Decoder (No Code)

1. Copy your JWT token (from your browser DevTools, Postman, or auth logs)
2. Open the JWT Decoder
3. Paste the token into the input field
4. The header and payload are immediately shown as formatted JSON
5. Check expiration: the tool converts exp Unix timestamp to a human-readable date

Method 2: JavaScript (Browser / Node.js)

// Decode JWT payload without verifying signature
// ONLY use this for debugging — never for auth decisions
function decodeJwt(token) {
  const parts = token.split('.');
  if (parts.length !== 3) throw new Error('Invalid JWT format');

  // Base64URL → Base64 → JSON
  const decode = (str) => {
    const base64 = str.replace(/-/g, '+').replace(/_/g, '/');
    const json = atob(base64.padEnd(base64.length + (4 - base64.length % 4) % 4, '='));
    return JSON.parse(json);
  };

  return {
    header: decode(parts[0]),
    payload: decode(parts[1]),
    // Signature is binary — not decoded here
  };
}

const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
const { header, payload } = decodeJwt(token);
console.log(header);   // { alg: 'HS256', typ: 'JWT' }
console.log(payload);  // { sub: '1234567890' }

// Check if expired
if (payload.exp && Date.now() / 1000 > payload.exp) {
  console.log('Token expired at:', new Date(payload.exp * 1000));
}

Method 3: Python

import base64, json
from datetime import datetime

def decode_jwt(token: str) -> dict:
    """Decode JWT payload without signature verification (debug only)."""
    parts = token.split('.')
    if len(parts) != 3:
        raise ValueError("Invalid JWT format")

    def decode_part(part):
        # Add padding, convert Base64URL to Base64
        padding = 4 - len(part) % 4
        padded = part + '=' * (padding % 4)
        padded = padded.replace('-', '+').replace('_', '/')
        return json.loads(base64.b64decode(padded))

    header = decode_part(parts[0])
    payload = decode_part(parts[1])

    # Convert timestamps to human-readable
    if 'exp' in payload:
        payload['_exp_human'] = datetime.fromtimestamp(payload['exp']).isoformat()
    if 'iat' in payload:
        payload['_iat_human'] = datetime.fromtimestamp(payload['iat']).isoformat()

    return {'header': header, 'payload': payload}

# Or use the pyjwt library for full verification:
# pip install pyjwt
# import jwt
# payload = jwt.decode(token, secret, algorithms=["HS256"])

Standard JWT Claims Reference

JWT Security: What Developers Get Wrong

Frequently Asked Questions