How to Decode JWTs Safely Client-Side Without Leaking Tokens

JSON Web Tokens (JWTs) defined by RFC 7519 are the ubiquitous standard for authorizing microservices, Single Page Applications (SPAs), and mobile apps. Every developer working with OAuth 2.0 or OpenID Connect has needed to inspect a token's claims: checking when it expires (exp), verifying tenant or role claims, or reading the user ID (sub).

The Hidden Danger of Online Decoders

When you paste a token into an online tool that executes server-side, you transmit your raw token over HTTP to an unknown server. If that server logs request bodies, retains analytics, or suffers a security compromise, your session credentials, API privileges, and potentially user PII (Personally Identifiable Information) are exposed.

The Safe Alternative: Pure Client-Side Decoding

A JWT is not encrypted by default; it is simply Base64Url encoded. The token consists of three parts separated by dots:

Because the payload is merely encoded JSON, you do not need a server to inspect it! You can decode it entirely in your browser using pure JavaScript:

function decodeJwtPayload(token) {
  const parts = token.split('.');
  if (parts.length !== 3) {
    throw new Error('Invalid JWT format');
  }
  // Replace Base64URL characters with standard Base64
  const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
  // Decode Base64 string to UTF-8
  const jsonPayload = decodeURIComponent(
    atob(base64)
      .split('')
      .map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2))
      .join('')
  );
  return JSON.parse(jsonPayload);
}

Try Our Private JWT Decoder

We've built a full-featured, zero-network JWT Decoder directly into Swiss Army Dev Tool. It highlights headers, formats JSON payloads with syntax highlighting, flags expired tokens automatically, and converts epoch timestamps into local human dates.