Decode a JWT token

Read the JSON payload of a JSON Web Token — without verifying it.

JavaScript Version 1.0.0 · MIT · .md

function decodeJwtPayload(token) { const base64 = token.split('.')[1].replace(/-/g, '+').replace(/_/g, '/'); return JSON.parse(decodeURIComponent(Array.from(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '=')), char => `%${char.charCodeAt(0).toString(16).padStart(2, '0')}`).join(''))); }

Input & expected output

"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhbmFAZXhhbXBsZS5jb20iLCJuYW1lIjoiQW7DoSJ9.signature"

{
  "sub": "[email protected]",
  "name": "Aná"
}

The edge case

"x.eyJub3RlIjoiPz8-PjYiLCJ4Ijoifn5-Pz8_Pz8_In0.y"

{
  "note": "??>>6",
  "x": "~~~??????"
}

Know the limits

• Decoding is not verification: anyone can forge a payload. Verify the signature with your JWT library before trusting any claim.
• The original replaced only the first - and _ of the base64url text, corrupting longer payloads; this version replaces all and restores padding.

The function above is the implementation used by the lab. The lab validates JSON types and caps size before execution; include equivalent validation when accepting untrusted input in your application.

Keep exploring

• Convert Celsius to Fahrenheit — Apply the temperature conversion without rounding the result.
• Convert hex to RGB — Expand #rgb if needed and read the red, green and blue channels.
• Convert URL parameters to object — Read a query string into an object; repeated keys become arrays.