# Decode a JWT token

Read the JSON payload of a JSON Web Token — without verifying it.

Canonical: https://1loc.dev/misc/decode-a-jwt-token/
Version: 1.0.0
Runtime: JavaScript · Node.js 22 / modern browsers
Verification: Local fixtures; no external services
Updated: 2026-10-28

## Implementation

```javascript
function decodeJwtPayload(token) { const base64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'); return JSON.parse(decodeURIComponent(Array.from(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '=')), char => `%${char.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''))); }
```

## Input

```json
"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbmFAZXhhbXBsZS5jb20iLCJuYW1lIjoiQW7DoSJ9.signature"
```

## Expected output

```json
{
  "sub": "ana@example.com",
  "name": "Aná"
}
```

## Edge case

Input:
```json
"x.eyJub3RlIjoiPz8-PjYiLCJ4Ijoifn5-Pz8_Pz8_In0.y"
```
Output:
```json
{
  "note": "??>>6",
  "x": "~~~??????"
}
```

## Limits

- Decoding is not verification: anyone can forge a payload. Verify the signature with your JWT library before trusting any claim.
- The original replaced only the first - and _ of the base64url text, corrupting longer payloads; this version replaces all and restores padding.

The lab validates types and size before calling this function. Add equivalent validation at your own trust boundary.

## Source and license

Original: https://github.com/phuocng/1loc/blob/14b481cf60dff1620ab1bb99a43b1f68068cdd9b/contents/decode-a-jwt-token.mdx
Author: Nguyen Huu Phuoc and original contributors
Contributors: See original repository history
Source commit: 14b481cf60dff1620ab1bb99a43b1f68068cdd9b
Copyright (c) 2020 phuoc-ng
License: MIT — https://1loc.dev/licenses/
Maintainer: Oveyon
Modifications: Replaces every base64url - and _ (the original replaced only the first of each) and restores padding; documents that decoding is not verification. Original MDX retained as inert source evidence.