How to Extract Your Username From a JWT Token

What a JWT token contains and where your username lives

A JWT token is three blocks of text separated by periods. The middle block — called the payload — holds the actual data about you, including your username. That middle section is encoded but not encrypted, which means anyone can read it if they know how to decode it. Your username is sitting there in plain sight once you separate the payload from the rest of the token.

The token looks like this: eyJhbGc... (first part) . eyJzdWI... (middle part with your data) . SflKxw... (signature). You need only the middle part to get your username out.

Key Takeaways

The username is stored in the middle section of a JWT token, which you can decode without any special permissions or keys.
Online JWT decoder tools at jwt.io or similar sites let you paste your token and see the username when ready, with no installation needed.
If you are writing code, your programming language has a built-in JWT library that extracts the username in one or two lines.
The username field name varies by system — it might be called "username", "sub", "user_id", or "email" depending on who issued the token.
Decoding a JWT to read your username is safe and does not require the secret key that signed the token.

Using an online decoder to read your username when ready

The fastest way to see your username is to visit jwt.io in your browser, paste your full token into the "Encoded" box on the left, and look at the decoded payload on the right. The payload appears as JSON — structured text with labels and values. Find the field that holds your username. Common field names are "username", "sub" (short for subject), "user_id", "email", or "preferred_username".

Other sites like debugjwt.com or jwtdebugger.io work the same way. Paste, decode, read. This method works on any device with a browser and takes ten seconds. The token is decoded in your browser, not sent to a server, so your token stays private.

Extracting the username in JavaScript or Node.js

If you are working in JavaScript, the simplest approach is to split the token and decode the middle part yourself. The middle section is Base64-encoded, which JavaScript can decode natively.

Here is the actual code:

const token = "your.jwt.token.here"; const parts = token.split('.'); const payload = JSON.parse(atob(parts[1])); const username = payload.username; // or payload.sub, payload.email, etc. console.log(username);

If you are using Node.js or a framework like Express, you can also install the jsonwebtoken package and use it to decode without manually splitting:

const jwt = require('jsonwebtoken'); const decoded = jwt.decode(token); // no secret key needed just to read const username = decoded.username;

The jwt.decode() method reads the token without verifying the signature, so you do not need the secret key. Verification — checking that the token is genuine — is a separate step that does require the key.

Extracting the username in Python

Python has a PyJWT library that handles JWT decoding. Install it with pip install PyJWT, then use it like this:

import jwt token = "your.jwt.token.here" decoded = jwt.decode(token, options={"verify_signature": False}) username = decoded.get('username') # or 'sub', 'email', etc. print(username)

The verify_signature=False option tells the library to skip signature verification and just decode the payload. This is safe when you only want to read the data, not verify that the token is authentic.

Finding the right field name for your username

Once you decode the token, you will see a JSON object with multiple fields. The username might not be labeled "username". Different systems use different names. Check what fields are actually in your token:

username — common in custom systems and some identity providers
sub — standard JWT field meaning "subject", often holds a user ID or email
email — if the system uses email as the unique identifier
user_id — numeric or alphanumeric user identifier
preferred_username — used by OpenID Connect providers like Okta or Auth0
name — the user's full name rather than a login username

Look at the decoded payload and find the field that matches what you know about your account. If you are unsure, check the documentation for the service that issued the token.

Why you can read the username without the secret key

A JWT token has three parts: a header, a payload, and a signature. The signature proves the token has not been tampered with, and verifying it requires the secret key. But reading the payload — including your username — requires no key at all. The payload is encoded in Base64, which is encoding, not encryption. Encoding is reversible by anyone; encryption requires a key.

This is by design. The token is meant to be read by the client (your browser or app) and by any server that receives it. Only the server that issued the token has the secret key to verify the signature. You can safely decode and read your own token without that key.

What to do if the username field is missing or empty

Some tokens are issued without a username field at all. This happens when the system uses a different identifier — like a numeric user ID or a session token that does not carry user information. Decode the token and look at all the fields present. One of them should identify you uniquely.

If the token is empty or contains only a signature with no payload data, the system may be using a reference token — a token that points to user data stored on the server rather than carrying the data itself. In that case, you cannot extract the username from the token alone; you would need to ask the server for the user information associated with that token.

Frequently Asked Questions

Is it safe to paste my JWT token into an online decoder?

It depends on the site. jwt.io decodes in your browser without sending the token to a server, so it is safe. Other sites may send your token to their servers. If you are concerned, use the offline method: split the token yourself in your browser console or use a library in your own code. Never paste a production token into a site you do not trust.

Can I change my username by editing the JWT token?

You can edit the payload, but the signature will no longer match. The server will reject the token because it will fail signature verification. Only the server that issued the token can create a valid signature, and it does that only when you log in or when the server itself updates your account.

What if my token has expired?

You can still decode an expired token and read the username. Expiration is checked by the server, not by the decoding process. The username data inside the token does not change when it expires. However, the server will reject the token for any real use, so reading the username is mostly useful for debugging.

Do I need different code to decode tokens from different providers?

No. All JWT tokens follow the same structure and encoding. The decoding process is identical whether the token came from Auth0, Okta, your own server, or any other source. The only difference is the field names inside the payload — you may need to look for "sub" instead of "username" depending on the provider.

What happens if I share my JWT token with someone else?

They can decode it and see everything in the payload, including your username and any other data stored there. They can also use the token to make requests on your behalf until it expires. Treat a JWT token like a password — keep it private and do not share it.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.