How to Decode a JWT Token: Step-by-Step Guide

What is a JWT Token?

A JSON Web Token (JWT) is a compact, URL-safe token used for authentication and data exchange. It consists of three parts separated by dots: header.payload.signature. You can decode the header and payload without a secret key — only the signature requires it for verification.

// Example JWT structure
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U

Step 1: Split the Token

Split the JWT string by the dot character (.). You will get three segments:

const token = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
const [header, payload, signature] = token.split(".");

Step 2: Decode Header and Payload

Each segment is Base64URL-encoded. Decode it by replacing - with + and _ with /, adding padding if needed, then decoding:

function decodeBase64Url(str) {
  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
  while (base64.length % 4) base64 += "=";
  return JSON.parse(atob(base64));
}

const header = decodeBase64Url(headerSegment);
// → { alg: "HS256" }

const payload = decodeBase64Url(payloadSegment);
// → { sub: "1234567890" }

Step 3: What Each Part Contains

Browser Console Quick Decode

You can paste this one-liner directly into your browser console to decode any JWT payload:

JSON.parse(atob("eyJzdWIiOiIxMjM0NTY3ODkwIn0"));
// → { sub: "1234567890" }