How to Decode JWT

1. What is Decode JWT

Decoding a JWT (JSON Web Token) means converting the Base64URL-encoded parts of the token back into human-readable JSON format. A JWT has three parts: header, payload, and signature. The header and payload are Base64URL encoded JSON objects that can be easily decoded. The signature is used to verify that the token has not been tampered with. Decoding is not the same as verifying - decoding just reads the data, while verifying checks the signature to ensure authenticity. It is important to note that anyone can decode a JWT; the signature is what provides security through verification.

2. Why It Matters

Being able to decode JWT tokens is essential for debugging authentication issues, understanding what data is in tokens, and verifying that tokens contain the correct claims. During development, you often need to inspect tokens to check expiration times, user roles, and other claims. JWT decoders make this quick and easy. Remember that decoding alone does not validate the token - always verify signatures in production code.

3. Example

JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

Header (decoded):
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload (decoded):
{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

The JWT is split by dots into three parts. The first two parts are Base64URL decoded to reveal the header and payload as JSON objects.

4. Common Mistakes