DevKit IconDevKit

JSON Web Token (JWT) Decoder

Decode JWT headers and claims locally in your browser; signature verification is not included.

How it works

JWT AUTH TOKEN STREAM

Header Schema Params
Awaiting a valid JWT…
Payload Claims Structure
Awaiting a valid JWT…
Dynamic Claim Calculations

Paste a JWT to inspect its claims.

Signature VerificationDecoding happens locally in your browser. This tool reads claims only; it does not verify the JWT signature.

How to decode a JWT

  1. Paste a JSON Web Token or Bearer token into the input field.
  2. DevKit decodes the JWT header and payload and displays them as formatted JSON.
  3. Review registered claims such as the issuer, audience, subject, expiration time, and issued-at time.
  4. Copy individual claims or the decoded header and payload when you need them for debugging.

Common JWT decoding uses

Inspect authentication tokens while debugging sign-in flows, check API token claims, confirm expiration times, and review custom authorization data such as roles, scopes, or permissions.

JWT security reminder

  • Decoding a JWT does not verify its signature or prove that it is trustworthy.
  • Always validate the signature, issuer, audience, and time-based claims in your application.
  • Treat JWTs as credentials and do not share production tokens unnecessarily.

JWT Decoder FAQ

What is a JWT Decoder?

A JWT Decoder reads the Base64URL-encoded header and payload in a JSON Web Token and displays their JSON content. It helps you inspect claims such as the issuer, audience, subject, and expiration time.

Does decoding a JWT verify that it is valid?

No. Decoding only makes the header and payload readable. A token must also have its signature verified with the correct key and expected issuer, audience, and expiration rules before it can be trusted.

Can I paste a Bearer token?

Yes. You can paste either a compact JWT or a value beginning with Bearer. DevKit removes the Bearer prefix before decoding the token.

Is my JWT uploaded to a server?

No. JWT decoding happens locally in your browser. DevKit does not upload or store the token you inspect with this tool.

What are exp, iat, and nbf JWT claims?

exp is the token expiration time, iat is the time it was issued, and nbf is the time before which it should not be accepted. These registered claims use Unix timestamps when present.