JWT Decoder

// Using firebase/php-jwt (decode without verification)
use Firebase\JWT\JWT;
$parts = explode('.', $token);
$header = json_decode(JWT::urlsafeB64Decode($parts[0]));
$payload = json_decode(JWT::urlsafeB64Decode($parts[1]));

// With verification (recommended for production)
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
try {
    $decoded = JWT::decode($token, new Key($secret, 'HS256'));
    // Token is valid and verified
} catch (Exception $e) {
    // Token invalid or expired
}

// Browser or Node.js: Decode without verification
function decodeJWT(token) {
    const parts = token.split('.');
    const header = JSON.parse(atob(parts[0]));
    const payload = JSON.parse(atob(parts[1]));
    return { header, payload };
}

// Using jsonwebtoken library (Node.js)
const jwt = require('jsonwebtoken');
const decoded = jwt.decode(token); // No verification

// With verification (recommended)
try {
    const verified = jwt.verify(token, secret);
    // Token is valid
} catch (err) {
    // Token invalid or expired
}

import jwt
import json
import base64

# Decode without verification
def decode_jwt(token):
    parts = token.split('.')
    header = json.loads(base64.urlsafe_b64decode(parts[0] + '=='))
    payload = json.loads(base64.urlsafe_b64decode(parts[1] + '=='))
    return header, payload

# Using PyJWT (decode without verification)
decoded = jwt.decode(token, options={"verify_signature": False})

# With verification (recommended)
try:
    verified = jwt.decode(token, secret, algorithms=["HS256"])
    # Token is valid
except jwt.ExpiredSignatureError:
    # Token expired
except jwt.InvalidTokenError:
    # Token invalid

import (
    "encoding/base64"
    "encoding/json"
    "strings"
)

// Decode without verification
func decodeJWT(token string) (map[string]interface{}, error) {
    parts := strings.Split(token, ".")
    payload, _ := base64.RawURLEncoding.DecodeString(parts[1])
    var claims map[string]interface{}
    json.Unmarshal(payload, &claims)
    return claims, nil
}

// Using golang-jwt/jwt with verification
import "github.com/golang-jwt/jwt/v5"
token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {
    return []byte(secret), nil
})
if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
    // Token verified and valid
}

// Using java-jwt (Auth0)
import com.auth0.jwt.JWT;
import com.auth0.jwt.interfaces.DecodedJWT;

// Decode without verification
DecodedJWT jwt = JWT.decode(token);
String subject = jwt.getSubject();
Date expiresAt = jwt.getExpiresAt();

// With verification (recommended)
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.JWTVerifier;
try {
    Algorithm algorithm = Algorithm.HMAC256(secret);
    JWTVerifier verifier = JWT.require(algorithm).build();
    DecodedJWT jwt = verifier.verify(token);
    // Token is valid
} catch (Exception e) {
    // Token invalid
}

require 'jwt'

# Decode without verification
decoded = JWT.decode(token, nil, false)
payload = decoded[0]
header = decoded[1]

# With verification (recommended)
begin
  decoded = JWT.decode(token, secret, true, { algorithm: 'HS256' })
  payload = decoded[0]
  # Token is valid
rescue JWT::ExpiredSignature
  # Token expired
rescue JWT::DecodeError
  # Token invalid
end

using System.IdentityModel.Tokens.Jwt;

// Decode without verification
var handler = new JwtSecurityTokenHandler();
var jwtToken = handler.ReadJwtToken(token);
var claims = jwtToken.Claims;
var expiration = jwtToken.ValidTo;

// With verification (recommended)
using Microsoft.IdentityModel.Tokens;
var tokenHandler = new JwtSecurityTokenHandler();
var key = Encoding.ASCII.GetBytes(secret);
try {
    var principal = tokenHandler.ValidateToken(token,
        new TokenValidationParameters {
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(key),
            ValidateIssuer = false,
            ValidateAudience = false
        }, out SecurityToken validatedToken);
    // Token is valid
} catch {
    // Token invalid
}