How to decode a JWT in Node.js

Learn how to decode a JWT in Node.js without a signing secret, inspect alg/typ and claims, and avoid the common mistake of treating decode as authentication. Use the free browser JWT Decoder for quick inspection, then verify with jsonwebtoken before trusting any claim in production.

Last updated August 26, 2026

Steps

  1. 1

    Open the JWT Decoder tool and paste a sample token (avoid production tokens on shared machines).

  2. 2

    Inspect the decoded header (alg, typ, kid) and payload (sub, exp, custom claims) — processing stays in your browser.

  3. 3

    In Node.js, decode with jsonwebtoken the same way for logging/debugging only.

  4. 4

    Add signature verification with an explicit algorithm allowlist before authorizing any request.

  5. 5

    Confirm expired and tampered tokens fail verification using the JWT Validator or your test suite.

Code Example

Node.js
const jwt = require('jsonwebtoken');

// Inspect only — decode does NOT prove authenticity
const decoded = jwt.decode(token, { complete: true });
if (!decoded) throw new Error('Malformed JWT');
console.log(decoded.header);  // alg, typ, kid
console.log(decoded.payload); // sub, exp, claims

// Production: always verify with an allowlisted algorithm
const verified = jwt.verify(token, process.env.JWT_SECRET, {
  algorithms: ['HS256'],
});
Open JWT Decoder

Other languages

Node.jsPythonGoJavaRuby

Related Articles

Jwt Decode Without SecretHow To Validate Jwt Token

Frequently Asked Questions

Does decoding a JWT verify the signature?

No. Decoding only Base64URL-decodes the header and payload. Anyone with the token string can read claims. Verification with your secret or public key proves the token was not forged.

How do I decode a JWT in Node.js safely?

Use jsonwebtoken to inspect claims during debugging, but never authorize based on decode alone. In production call verify/decode-with-verify and pass an explicit algorithms allowlist.

Is the browser JWT Decoder safe to use?

Yes for local inspection — decoding runs client-side and nothing is uploaded. Still avoid pasting high-privilege production tokens on untrusted devices.

Can someone read my JWT without the secret?

Yes. Standard JWTs (JWS) are signed, not encrypted. Do not put passwords, session secrets, or sensitive PII in the payload.