How to decode a JWT in Java

Learn how to decode a JWT in Java without a signing secret, inspect alg/typ and claims, and avoid the common mistake of treating decode as authentication. Use the free browser JWT Decoder for quick inspection, then verify with java-jwt (Auth0) before trusting any claim in production.

Last updated August 26, 2026

Steps

  1. 1

    Open the JWT Decoder tool and paste a sample token (avoid production tokens on shared machines).

  2. 2

    Inspect the decoded header (alg, typ, kid) and payload (sub, exp, custom claims) — processing stays in your browser.

  3. 3

    In Java, decode with java-jwt (Auth0) the same way for logging/debugging only.

  4. 4

    Add signature verification with an explicit algorithm allowlist before authorizing any request.

  5. 5

    Confirm expired and tampered tokens fail verification using the JWT Validator or your test suite.

Code Example

Java
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;

// Inspect only — decode does NOT prove authenticity
DecodedJWT jwt = JWT.decode(token);
System.out.println(jwt.getAlgorithm());
System.out.println(jwt.getClaim("sub").asString());

// Production: verify with an allowlisted algorithm
DecodedJWT verified = JWT.require(Algorithm.HMAC256(secret))
    .build()
    .verify(token);
Open JWT Decoder

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwt Decode Without SecretHow To Validate Jwt Token

Frequently Asked Questions

Does decoding a JWT verify the signature?

No. Decoding only Base64URL-decodes the header and payload. Anyone with the token string can read claims. Verification with your secret or public key proves the token was not forged.

How do I decode a JWT in Java safely?

Use java-jwt (Auth0) to inspect claims during debugging, but never authorize based on decode alone. In production call verify/decode-with-verify and pass an explicit algorithms allowlist.

Is the browser JWT Decoder safe to use?

Yes for local inspection — decoding runs client-side and nothing is uploaded. Still avoid pasting high-privilege production tokens on untrusted devices.

Can someone read my JWT without the secret?

Yes. Standard JWTs (JWS) are signed, not encrypted. Do not put passwords, session secrets, or sensitive PII in the payload.