JWT Decoder

About the JWT Decoder

Paste a JSON Web Token and this decoder splits it into its three segments, base64url-decodes the header and payload, and shows the claims as readable JSON, including whether the token has already expired.

A JWT is three base64url-encoded segments joined by dots: header, payload and signature. The first two are only encoded, not encrypted, so anyone holding the token can read them. Decoding is therefore a local operation and needs no key.

What you can do with it

• JWT token viewer
• JSON web token decoder
• Decode JWT online
• JWT parser

How to use it

1. Paste your input into the input pane.
2. Pick the direction you want: encode or decode, source format or target format.
3. The converted result appears immediately in the output pane.
4. Use Copy to take the result, or pipe it into another tool from the workspace.

Questions

Does this verify the signature?

No. Verifying a signature requires the secret or public key that signed the token, and handing a signing key to a web page is exactly the habit this site is built to avoid. The decoder reads the header and payload, which is what you need for debugging.

Is it safe to paste a real token here?

The decoding happens in your browser and the token is never transmitted. That said, a JWT is a live credential until it expires, so treat pasting one anywhere with the same care you would a password, and prefer an expired or test token when you can.

Is my data uploaded anywhere?

No. The tool is JavaScript that runs in the tab you already have open, and DevToolbox has no backend to send anything to. You can open the network tab and watch: after the page and its script load, nothing is sent while you work.

Does it work offline?

Once the page has loaded, yes. The tool needs no network access to do its job, so it keeps working if your connection drops. Reloading the page does need the network unless your browser has it cached.

Related tools

The JWT Decoder sits in Encoders & Converters, one of the 90 tools on DevToolbox.