How to Decode JSON Web Tokens (JWT) Locally and Safely

JSON Web Tokens (JWTs) are the standard protocol for stateless session management. However, because they are Base64URL-encoded, developers often use public decoder sites to view the claims inside them.

This is highly insecure. A JWT contains user roles, scopes, emails, and sometimes even secrets. If a third-party site logs these tokens, they could potentially hijack active sessions.

Decoding Safely

You can easily decode a JWT payload locally in your browser console using vanilla JavaScript:

function decodeJWTPayload(token) {
  const parts = token.split('.');
  if (parts.length !== 3) {
    throw new Error('Invalid JWT format');
  }
  const payloadBase64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
  const jsonPayload = decodeURIComponent(
    atob(payloadBase64)
      .split('')
      .map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
      .join('')
  );
  return JSON.parse(jsonPayload);
}

Our JWT Decoder tool automates this process completely on the client side, showing header, payload, and signature integrity checks instantly and privately.