DevDesk

SECURITY / DEVDESK

JWT Decoder

Decode the Base64URL header and payload of a JWT as UTF-8 JSON. This tool does not verify signatures.

Decoding does not verify the signature, issuer, or trustworthiness. Forged values can be displayed, so do not trust claims until your server verifies the token. The token is processed only in this browser and is not stored or sent.

Input
0 charactersUTF-8

Input and output examples

Example 1

Input

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vIiwiZXhwIjoxODkzNDU2MDAwfQ.

Output

{
  "alg": "none",
  "typ": "JWT"
}

{
  "sub": "demo",
  "exp": 1893456000
}

Example 2

Input

eyJhbGciOiJIUzI1NiJ9.eyJyb2xlIjoicmVhZGVyIn0.signature

Output

{
  "alg": "HS256"
}

{
  "role": "reader"
}

How to use it

  1. Paste the complete dot-separated JWT.
  2. Inspect its header, payload, and time claims.
  3. Review UTC and local timestamps and the browser-clock expiry status.

Frequently asked questions

Does it verify the token signature?

No. It only reads the header and payload; it performs no signature verification or server authentication.

How are exp and nbf displayed?

They are interpreted as Unix seconds and shown in UTC and browser-local time. Expiry is evaluated using the browser clock.

Should I paste a production token?

Inputs are not sent externally, but avoid pasting sensitive production tokens. Do not save token contents in logs or URLs.

Full usage guide: JWT Decoder