How to Decode a JWT Token Without Sending It to a Server

May 10, 2025 · 4 min read

JSON Web Tokens (JWTs) are everywhere in modern auth systems — OAuth 2.0, OpenID Connect, API authentication. When debugging, the first thing you often need is to see what claims are inside the token and whether it has expired.

But many developers paste tokens into online tools without thinking about the risk. Here is how JWTs work and how to decode them safely.

The structure of a JWT

A JWT is three Base64URL-encoded segments separated by dots:

header.payload.signature

The header contains the algorithm (e.g., HS256, RS256). The payload contains claims like sub (subject), exp (expiry), iat (issued at), and any custom claims from your identity provider. The signature validates authenticity — but you need the secret key to verify it.

Decoding in JavaScript (client-side only)

The header and payload can be decoded without the secret — they are just Base64URL-encoded JSON:

function decodeJWT(token) {
  const [header, payload] = token.split('.');
  const decode = (str) => JSON.parse(atob(str.replace(/-/g, '+').replace(/_/g, '/')));
  return { header: decode(header), payload: decode(payload) };
}

const { header, payload } = decodeJWT(yourToken);
console.log(payload.exp, payload.sub);

This runs entirely in the browser. The token never leaves your machine. This is exactly what the Hexabench JWT Decoder does.

Checking expiry

The exp claim is a Unix timestamp. To check if a token is expired:

const isExpired = payload.exp * 1000 < Date.now();

Is it safe to paste a JWT into an online tool?

The header and payload are not secret — they are just encoded, not encrypted. However, if your token contains sensitive claims (user IDs, emails, roles) and is long-lived, you should avoid pasting it into third-party services that might log requests.

A browser-based decoder that runs entirely client-side (no server) is safe to use — the token never leaves your tab. Always check that the tool you are using does not make network requests when decoding.

Verifying the signature

Decoding shows you the claims. Verification confirms the token was signed by a trusted party and has not been tampered with. This requires the signing key and should always be done server-side, never in the browser.

Try the JWT Decoder → · Back to Blog