JWT Decoder
Decode JSON Web Tokens to inspect the header, payload and expiry.
Encoded token
Summary
Decoded claims will appear here
About the JWT Decoder
Decode any JSON Web Token (JWT) to see what's inside. DevNest splits the token into its header, payload and signature, pretty-prints the JSON, and turns standard claims like exp, iat and nbf into readable dates — including whether the token has expired.
Tokens often contain personal data and grant access to systems, so decoding happens entirely in your browser. Your token is never sent anywhere.
How to use the JWT Decoder
- 1
Paste your token
Paste a JWT into the input. A leading “Bearer ” from an Authorization header is removed automatically.
- 2
Read the summary
See the algorithm, issuer, subject, audience and a badge showing when the token expires.
- 3
Inspect the JSON
The header and payload are shown as formatted, syntax-highlighted JSON you can copy.
- 4
Verify on your server
Remember that decoding doesn't check the signature — always verify it before trusting a token.
Frequently asked questions
What is a JWT?
A JSON Web Token is a compact, URL-safe way to send claims between systems, commonly used for login sessions and API authorization. It has three Base64URL-encoded parts separated by dots: a header, a payload and a signature.
Does this tool verify the JWT signature?
No. It only decodes the header and payload, which doesn't require any key. Anyone can create a token with any contents, so your server must always verify the signature with the correct secret or public key before trusting a token.
Is it safe to paste my token here?
Decoding happens locally in your browser and the token is never uploaded. Even so, treat production tokens like passwords: avoid sharing them, and prefer test tokens when you can.
What do exp, iat and nbf mean?
They are registered time claims measured in seconds since 1 January 1970 (Unix time). exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted.
Are JWTs encrypted?
Standard signed JWTs (JWS) are only encoded, not encrypted, so anyone can read the payload. Never put secrets in a JWT payload. Encrypted JWTs (JWE) have five parts and cannot be read without the decryption key.
More free developer tools
JSON Formatter
Beautify, minify and validate JSON instantly as you type.
Base64 Encoder/Decoder
Convert text to Base64 and back, with full Unicode support.
UUID Generator
Generate random v4 UUIDs — one or many — in the format you need.
Timestamp Converter
Convert Unix timestamps to dates and dates to timestamps.
URL Encoder/Decoder
Percent-encode and decode URLs, and break down query strings.
Hash Generator
Generate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.
Regex Tester
Test regular expressions with live match highlighting and groups.