Decode JWT tokens online and inspect headers, payload claims, issuer, audience, expiration time, and custom fields directly in your browser. Your token never leaves your device.
How it worksInspect authentication tokens while debugging sign-in flows, check API token claims, confirm expiration times, and review custom authorization data such as roles, scopes, or permissions.
A JWT Decoder reads the Base64URL-encoded header and payload of a JSON Web Token (JWT) and displays them as readable JSON. It helps developers inspect claims such as the issuer (iss), subject (sub), audience (aud), expiration time (exp), and issued-at time (iat).
No. Decoding only makes the JWT header and payload readable. A decoded JWT should never be trusted unless its signature is verified with the correct signing key and its issuer, audience, and expiration claims are validated.
Yes. If the Bearer token contains a JWT, DevKit automatically removes the 'Bearer' prefix and decodes the token. If the token is not a JWT, it cannot be decoded by this tool.
Many OAuth 2.0 and OpenID Connect providers issue JWT-based access tokens that can be decoded. Some providers use opaque access tokens instead, which cannot be decoded because they do not contain a readable JWT payload.
Some authentication providers issue refresh tokens as JWTs, while others use opaque strings. Only refresh tokens that are JWTs can be decoded and inspected with this tool.
Standard JWT claims include iss (issuer), sub (subject), aud (audience), exp (expiration time), iat (issued at), nbf (not before), and jti (JWT ID). Applications can also include custom claims such as roles, permissions, or user information.
No. Standard JWTs are Base64URL encoded, not encrypted. Decoding simply converts the encoded header and payload into readable JSON. Encrypted JWTs (JWEs) require decryption and are not supported by this decoder.
No. This tool is designed only for decoding JWTs. Signature verification requires the correct secret or public key, depending on the signing algorithm, and should be performed by your application or backend.
No. All JWT decoding happens locally in your browser. DevKit does not upload, transmit, or store your token, making it safe for inspecting development and testing tokens.
Yes. You can paste either a compact JWT or an authorization header beginning with 'Bearer'. DevKit automatically removes the prefix before decoding the JWT.
A token can only be decoded if it is a valid JWT containing three Base64URL-encoded sections separated by periods. Opaque access tokens, malformed tokens, or encrypted JWTs (JWEs) cannot be decoded by this tool.
A JWT Decoder reads and displays the contents of a token, while a JWT Validator verifies the token's signature, issuer, audience, expiration, and other security requirements. Decoding is useful for debugging, whereas validation is required before trusting a JWT in production.
Continue with a related CloudDevKit tool.
