JWT Token ohne Bibliothek dekodieren: JavaScript, Python, Bash One-Liner

Every JWT is just three Base64URL-encoded strings separated by dots. You do not need jsonwebtoken, PyJWT, or any library to read what is inside. This guide gives you working one-liners in JavaScript, Node.js, Python, Bash, Go, and PHP so you can decode any JWT token instantly from any environment.

1. JWT Structure: header.payload.signature

A JWT consists of exactly three parts separated by periods. The first two parts (header and payload) are Base64URL-encoded JSON objects. The third part is the cryptographic signature. You only need to decode the first two parts to read the token contents.

┌─────────────────────────────────────────────────────────────────────────────────┐
│                              JWT Token Layout                                   │
├──────────────────┬──────────────────────────────────┬──────────────────────────┤
│     HEADER       │           PAYLOAD                │       SIGNATURE          │
│  (algorithm)     │        (your data)               │    (verification)        │
├──────────────────┼──────────────────────────────────┼──────────────────────────┤
│ eyJhbGciOiJIUz   │ eyJzdWIiOiIxMjM0NTY3ODkwIiwi   │ SflKxwRJSMeKKF2QT4fw    │
│ I1NiIsInR5cCI6   │ bmFtZSI6IkpvaG4gRG9lIiwiaWF0   │ pMeJf36POk6yJV_adQss    │
│ IkpXVCJ9         │ IjoxNTE2MjM5MDIyfQ              │ w5c                      │
├──────────────────┼──────────────────────────────────┼──────────────────────────┤
│ Base64URL({      │ Base64URL({                      │ HMACSHA256(              │
│   "alg": "HS256" │   "sub": "1234567890",           │   header + "." +         │
│   "typ": "JWT"   │   "name": "John Doe",            │   payload,               │
│ })               │   "iat": 1516239022              │   secret                 │
│                  │ })                               │ )                        │
└──────────────────┴──────────────────────────────────┴──────────────────────────┘

Full token (dots separate the three parts):
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

2. JavaScript One-Liner (Browser)

The browser provides atob() to decode Base64 strings. Combined with JSON.parse(), you get a single expression that decodes any JWT payload. Note that atob() expects standard Base64, so we must replace the URL-safe characters first.

// Decode JWT payload in the browser — one line
JSON.parse(atob('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[1].replace(/-/g,'+').replace(/_/g,'/')))

// Result: { sub: "1234567890", name: "John Doe", iat: 1516239022 }

// Reusable function (handles UTF-8 payloads too):
const jwtDecode = (t) => JSON.parse(decodeURIComponent(atob(t.split('.')[1].replace(/-/g,'+').replace(/_/g,'/')).split('').map(c => '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)).join('')));

// Decode the header:
JSON.parse(atob('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[0].replace(/-/g,'+').replace(/_/g,'/')))

3. Node.js One-Liner

Node.js does not have atob() in older versions, but Buffer.from() handles Base64URL natively since Node 15.7+. This is the cleanest approach for server-side JavaScript.

// Node.js — decode JWT payload in one line
JSON.parse(Buffer.from('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[1], 'base64url').toString())

// Result: { sub: '1234567890', name: 'John Doe', iat: 1516239022 }

// Decode header:
JSON.parse(Buffer.from('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[0], 'base64url').toString())

// For Node < 15.7 (no 'base64url' encoding):
JSON.parse(Buffer.from('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[1].replace(/-/g,'+').replace(/_/g,'/'), 'base64').toString())

4. Python One-Liner

Python's base64 module has urlsafe_b64decode which handles the URL-safe alphabet directly. The only catch is that you need to add padding, because JWT strips trailing = characters.

# Python — decode JWT payload in one line
import json, base64; print(json.loads(base64.urlsafe_b64decode('eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[1] + '==')))

# Result: {'sub': '1234567890', 'name': 'John Doe', 'iat': 1516239022}

# Proper padding (handles any token length):
import json, base64; p = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[1]; print(json.loads(base64.urlsafe_b64decode(p + '=' * (-len(p) % 4))))

# Decode header:
import json, base64; h = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'.split('.')[0]; print(json.loads(base64.urlsafe_b64decode(h + '=' * (-len(h) % 4))))

# Result: {'alg': 'HS256', 'typ': 'JWT'}

5. Bash One-Liner

Using standard Unix tools (cut, base64, jq), you can decode JWTs directly in your terminal. This is invaluable for debugging in CI/CD pipelines, Docker containers, and SSH sessions.

# Bash — decode JWT payload with base64 and jq
echo 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' | cut -d. -f2 | base64 -d 2>/dev/null | jq .

# Output:
# {
#   "sub": "1234567890",
#   "name": "John Doe",
#   "iat": 1516239022
# }

# macOS (uses -D flag for base64 decode):
echo 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' | cut -d. -f2 | base64 -D 2>/dev/null | jq .

# Decode header (change -f2 to -f1):
echo 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' | cut -d. -f1 | base64 -d 2>/dev/null | jq .

# Handle padding automatically (works on both Linux and macOS):
jwt='eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'; p=$(echo "$jwt" | cut -d. -f2); echo "$p"$(printf '%0.s=' $(seq 1 $((4 - ${#p} % 4)))) | base64 -d 2>/dev/null | jq .

# Without jq (Python fallback):
echo 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c' | cut -d. -f2 | base64 -d 2>/dev/null | python3 -m json.tool

6. Go One-Liner (Compact Function)

Go's standard library includes encoding/base64 with RawURLEncoding which handles Base64URL without padding. No third-party packages needed.

package main

import (
    "encoding/base64"
    "encoding/json"
    "fmt"
    "strings"
)

func decodeJWT(token string) (header, payload map[string]interface{}, err error) {
    parts := strings.Split(token, ".")
    if len(parts) != 3 {
        return nil, nil, fmt.Errorf("invalid JWT: expected 3 parts, got %d", len(parts))
    }
    // Decode header
    hBytes, err := base64.RawURLEncoding.DecodeString(parts[0])
    if err != nil { return nil, nil, err }
    json.Unmarshal(hBytes, &header)
    // Decode payload
    pBytes, err := base64.RawURLEncoding.DecodeString(parts[1])
    if err != nil { return nil, nil, err }
    json.Unmarshal(pBytes, &payload)
    return header, payload, nil
}

func main() {
    token := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
    _, payload, _ := decodeJWT(token)
    fmt.Println(payload) // map[iat:1.516239022e+09 name:John Doe sub:1234567890]
}

// One-liner in Go playground:
// base64.RawURLEncoding.DecodeString(strings.Split(token, ".")[1])

7. PHP One-Liner

PHP's base64_decode() is tolerant of missing padding and can handle URL-safe characters after a simple strtr() translation. This works in any PHP version.

<?php
// PHP — decode JWT payload in one line
$payload = json_decode(base64_decode(strtr(explode('.', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c')[1], '-_', '+/')), true);
print_r($payload);

// Output:
// Array ( [sub] => 1234567890 [name] => John Doe [iat] => 1516239022 )

// Decode header:
$header = json_decode(base64_decode(strtr(explode('.', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c')[0], '-_', '+/')), true);
print_r($header);

// Output:
// Array ( [alg] => HS256 [typ] => JWT )

// As a reusable function:
function jwt_decode_payload(string $token): array {
    return json_decode(base64_decode(strtr(explode('.', $token)[1], '-_', '+/')), true);
}
?>

8. Why This Works: Base64URL vs Base64

JWT uses Base64URL encoding (RFC 4648 Section 5), which differs from standard Base64 in exactly two characters. Understanding this difference is the key to decoding JWTs without a library.

Standard Base64 uses + and / as the 62nd and 63rd characters, with = for padding. Base64URL replaces + with - and / with _, and strips the padding. This makes JWT tokens safe to embed in URLs, HTTP headers, and cookies without escaping.

// Conversion formula (any language):
base64url_to_base64(s) = s.replace(/-/g, '+').replace(/_/g, '/') + '==='.slice(0, (4 - s.length % 4) % 4)
base64_to_base64url(s) = s.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')

9. Security Warning: Decode != Verify

// WRONG: Using decoded payload for auth decisions
const user = JSON.parse(atob(token.split('.')[1]));
if (user.role === 'admin') grantAccess(); // DANGEROUS — token could be forged!

// RIGHT: Verify first, then trust the payload
const verified = jwt.verify(token, SECRET_KEY);     // Throws if invalid
if (verified.role === 'admin') grantAccess();        // Safe — signature checked

10. Common Pitfalls

// Fix padding issue (JavaScript):
const pad = (s) => s + '='.repeat((4 - s.length % 4) % 4);
JSON.parse(atob(pad(token.split('.')[1].replace(/-/g,'+').replace(/_/g,'/'))))

// Fix UTF-8 issue (Browser):
const decodeJWT = (token) => {
  const base64 = token.split('.')[1].replace(/-/g,'+').replace(/_/g,'/');
  const bytes = Uint8Array.from(atob(base64), c => c.charCodeAt(0));
  return JSON.parse(new TextDecoder().decode(bytes));
};

11. When to Use a Library Instead

Manual decoding is perfect for quick inspection, but you should use a proper JWT library when:

• You need to verify the signature (authentication and authorization).
• You need to check expiration (exp), not-before (nbf), and other time-based claims.
• You are handling RS256/ES256 tokens with public/private key pairs.
• You need to create (sign) new tokens, not just read existing ones.
• You are building middleware that gates access to protected routes.

FAQ