Inspect tool

JWT Decoder

Inspect JWT headers, claims, timestamps and signatures. Free, private and processed locally in your browser.

How JWT decoding works

A JSON Web Token contains Base64URL-encoded header and payload segments plus a signature. Decoding helps inspect claims during development and debugging, but it does not establish that the token is authentic, trusted or safe to accept.

Encoded token

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiI0MiIsInJvbGUiOiJlZGl0b3IiLCJleHAiOjE4OTM0NTYwMDB9.signature

Decoded header and payload

Header
{
  "alg": "HS256",
  "typ": "JWT"
}

Payload
{
  "sub": "42",
  "role": "editor",
  "exp": 1893456000
}

JWT safety and claim pitfalls

Decoded is not verified: Readable claims prove only that the segments can be decoded. A trusted server must verify the signature, expected algorithm, issuer and audience.
Time claims use seconds: The exp, nbf and iat claims are normally Unix seconds, not JavaScript milliseconds. Multiplying by 1,000 converts them for a Date object.
Tokens can contain sensitive data: JWT payloads are encoded, not encrypted. Avoid placing passwords, secrets or private personal data in claims.

Frequently asked questions

Can anyone decode a JWT?: Yes. Anyone holding a token can usually read its header and payload. The signature prevents undetected changes; it does not hide the claims.
Does this tool verify the signature?: No. Verification requires the correct key and application-specific checks for algorithm, issuer, audience and token lifetime.
Is the token uploaded?: No. DevKitFern decodes the token locally in your browser and does not send it to a server.