Decode JWT Payloads Locally: What the Claims Tell You (and Don't)
JWTs are designed to be readable by the client. That is useful for debugging, but it also means a real token can contain user IDs, email addresses, roles, scopes and expiry data that should not be pasted into a random online decoder. The practical distinction is simple: decoding a JWT is not decrypting it, and decoding it is not verifying its signature. Read the three sections first A compact JWT…
JSON Web Tokens (JWTs) are designed to be readable by the client, which aids debugging but also poses security risks. Revealing user IDs, email addresses, roles, scopes, and expiry data in a token can be problematic. Decoding a JWT is merely deciphering it, not decrypting or verifying its signature. A JWT's structure typically consists of a header, payload, and signature, separated by periods.
The header indicates the token type and signing algorithm, while the payload contains JSON claims, and the signature proves the issuer signed the other parts. All three components use Base64url encoding, not encryption. While anyone with the token can decode these sections, they should treat the token as sensitive due to the potential presence of sensitive information.
For a quick check, you can split the token in your browser's developer tools and decode the header and payload parts. These parts use hyphens and underscores instead of plus signs and slashes, so you'll need to replace them and add padding to decode them correctly. Utilize the following JavaScript function to decode a part: `const decodePart = (part) => { const base64 = part.replace(/-/g, "+").replace(/_/g, "/"); const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "="); return JSON.parse(atob(padded)); };` Decode the encoded header and payload sections separately using this function.
Log the results to the console. It's advisable to use a redacted fixture when possible to prevent leaking information. The claims to focus on include `exp` (expiry), `iat` (issued at), `aud` (audience), `iss` (issuer), `sub` (subject), and `scope` or `roles`. The presence of an admin role in the payload does not confirm the token's validity or server acceptance; it merely reveals what the token claims.
Always remember that signature validation, issuer configuration, audience checks, and server-side authorization remain essential. Although the browser console is excellent for a one-off check, developing a local browser tool can streamline the process if you regularly inspect tokens. Tools like TextForge's JWT and Base64 workflow allow you to paste the payload section, decode it, copy the JSON, and clear the input without sending the token to a third-party decoder.
The key principle remains consistent: decode only what you need, understand that readability does not equate to authenticity, and avoid pasting production credentials into public forms, even if the page suggests it's convenient. The original guide can be found at https://wendygostudio.com/blog/decode-jwt-online/.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
