JWT Decoder
Decode JWT headers and payload claims directly in your browser. This tool helps inspect token structure, registered claims, and expiry windows, but it does not verify signatures or decrypt JWE tokens.
Paste a token
Supports header.payload.signature JWTs and 2-part header.payload samples. Nothing is sent to a server.
JWT summary
Quickly inspect the most useful header and payload fields without digging through raw JSON.
Header
Header metadata usually tells you how the token was signed and which key to look for.
{
"alg": "HS256",
"typ": "JWT",
"kid": "devtoolbox-demo"
}{"alg":"HS256","typ":"JWT","kid":"devtoolbox-demo"}Payload
Payload claims describe the subject, issuer, audience, and validity window.
{
"iss": "https://devtoolbox.dev",
"sub": "user_123456",
"aud": [
"devtoolbox-web",
"internal-tools"
],
"scope": "read:profile debug:token",
"iat": 1760000000,
"nbf": 1760000000,
"exp": 2208988800
}{"iss":"https://devtoolbox.dev","sub":"user_123456","aud":["devtoolbox-web","internal-tools"],"scope":"read:profile debug:token","iat":1760000000,"nbf":1760000000,"exp":2208988800}Raw segments
Sometimes you need the exact Base64URL segments for debugging middleware, proxies, or CLI tools.
Time-based claims
These registered claims usually drive session validity and auth middleware decisions.
Important note
JWT decoding and JWT verification are different operations.
This page only decodes Base64URL-encoded JSON in the header and payload. It does not prove the token was issued by a trusted authority.
Signature verification still requires the correct secret or public key, and encrypted JWE tokens require decryption before their payload can be inspected.
Common use cases
Practical ways developers use the JWT decoder in real workflows.
Inspect auth tokens
Decode a JWT to check the issuer, audience, expiration, and custom claims during authentication debugging.
Verify token expiry
Quickly see when a token was issued and when it expires without writing decoding code.
Review token structure
Examine the header to confirm the signing algorithm and key ID match your expected configuration.
Frequently asked questions
Short answers to the questions people usually have before using the tool.
Does this tool verify the JWT signature?+
No. It decodes the header and payload, which are Base64url-encoded and not encrypted. Signature verification requires the signing secret or public key.
Is it safe to paste JWTs from production?+
The decoding happens entirely in your browser and no data is sent to a server. However, treat production tokens as sensitive and avoid sharing the decoded output.
What are the exp, iat, and nbf claims?+
exp is the expiration time, iat is the issued-at time, and nbf is the not-before time. All are Unix timestamps that control when the token is valid.
Related tools
Keep moving through related utility tasks without leaving the toolbox.
Create secure random passwords with custom length and character groups.
Generate SHA-256, SHA-512, SHA-1 hashes using the Web Crypto API.
Generate random UUIDs (v4) with one click. Bulk generation supported.
Convert text into uppercase, lowercase, camelCase, snake_case, and more.