DevDesk

DEVDESK / GUIDE

JWT Decoder — Usage guide

Decode the Base64URL header and payload of a JWT as UTF-8 JSON. This tool does not verify signatures.

How to use it

  1. Paste the complete dot-separated JWT.
  2. Inspect its header, payload, and time claims.
  3. Review UTC and local timestamps and the browser-clock expiry status.

Input and output examples

Example 1

Input

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vIiwiZXhwIjoxODkzNDU2MDAwfQ.

Output

{
  "alg": "none",
  "typ": "JWT"
}

{
  "sub": "demo",
  "exp": 1893456000
}

Example 2

Input

eyJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoicmVhZGVyIn0.signature

Output

{
  "alg": "HS256"
}

{
  "role": "reader"
}

Frequently asked questions

Does it verify the token signature?

No. It only reads the header and payload; it performs no signature verification or server authentication.

How are exp and nbf displayed?

They are interpreted as Unix seconds and shown in UTC and browser-local time. Expiry is evaluated using the browser clock.

Should I paste a production token?

Inputs are not sent externally, but avoid pasting sensitive production tokens. Do not save token contents in logs or URLs.

Open tool