What is a JWT?

A JSON Web Token is three dot-separated Base64url segments: a JSON header, a JSON claims payload, and a signature. The signature can protect integrity and authenticity only when a trusted verifier checks it with the expected algorithm and key.

Why use JWT?

JWTs carry signed claims between services for sessions, API authorization, and federated identity. This decoder only displays the header, payload, and signature text; it does not verify the signature, expiry, issuer, or audience, so never trust decoded claims without server-side validation.

JWT in Bash

Vanilla (base64 + jq)

# Decode JWT header and payload
jwt="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
echo "$jwt" | cut -d'.' -f1 | base64 -d 2>/dev/null | jq .
echo "$jwt" | cut -d'.' -f2 | base64 -d 2>/dev/null | jq .

Using jwt-cli

# Install: https://github.com/mike-engel/jwt-cli
jwt decode "$jwt"

JWT in JavaScript

Using jsonwebtoken (Node.js)

const jwt = require('jsonwebtoken');
const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header);
console.log(decoded.payload);

Vanilla (Browser)

const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
const payload = JSON.parse(atob(token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/')));
console.log(payload);

Vanilla (Node.js)

const token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString());
console.log(payload);

JWT in Go

Using golang-jwt/jwt

package main
import (
	"fmt"
	"github.com/golang-jwt/jwt/v5"
)
func main() {
	token := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
	parsed, err := jwt.Parse(token, func(token *jwt.Token) (interface{}, error) {
		return []byte("your-secret"), nil
	})
	if err != nil {
		panic(err)
	}
	fmt.Println(parsed.Header)
	fmt.Println(parsed.Claims)
}

Vanilla (standard library)

package main
import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"strings"
)
func main() {
	token := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
	parts := strings.Split(token, ".")
	payload, _ := base64.RawURLEncoding.DecodeString(parts[1])
	var claims map[string]interface{}
	json.Unmarshal(payload, &claims)
	fmt.Println(claims)
}

JWT in PHP

Using firebase/php-jwt

<?php
require 'vendor/autoload.php';
use Firebase\JWT\JWT;
use Firebase\JWT\Key;

$token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
$decoded = JWT::decode($token, new Key('your-secret', 'HS256'));
print_r($decoded);
?>

Vanilla

<?php
$token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
$parts = explode(".", $token);
$payload = json_decode(base64_decode(strtr($parts[1], "-_", "+/")), true);
print_r($payload);
?>

JWT Decoder

Decode JWT

About JWT