JWT Decoder
Security toolInspect header, payload and expiry of a JSON Web Token — never sent to a server.
Frequently asked questions
Is my JWT sent to a server?
No. The token is decoded entirely in your browser with base64url decoding — nothing is transmitted, logged, or stored, which matters since a JWT payload often contains user or session data.
Does this verify the signature?
No — this is a decode-only inspector. Verifying a signature needs the signing secret or public key, and typing that into any web page (even this one) would defeat the point of keeping your token private. Use your backend's JWT library to verify.
What do "expired" and "not yet valid" mean?
They're read from the token's exp and nbf claims (Unix timestamps) compared against your device's current clock — they show what the token itself claims, not a server-side check.
Why do I see "Invalid JWT — expected three dot-separated segments"?
A JWT is always header.payload.signature. That error means the pasted text is missing a segment — check for truncation when copying, or that it really is a JWT and not, say, an opaque API key.
About this tool
Inspect the readable parts of a JSON Web Token to understand its header and claims without sending the token to a server.
Workflow
- Paste the complete token, including its three dot-separated segments.
- Review the decoded header and payload claims.
- Check the displayed exp and nbf interpretation against the device clock.
- Use a backend library and the correct key when signature verification is required.
Things to know
- Decoding is not verification: a readable payload may still be forged or expired.
- Treat copied tokens as sensitive credentials even though this page does not transmit them.
- Clock-based expiry status reflects the token claims and the current device time.
JWT Decoder on devsutils.com — Inspect header, payload and expiry of a JSON Web Token — never sent to a server. It runs entirely in your browser: the input you paste is processed by client-side JavaScript and is never uploaded, logged, or stored. devsutils.com is a privacy-first suite of 70 developer utilities — JSON formatter, JWT decoder, Base64 encoder, regex tester, UUID generator, hash generator and more — with no accounts and no server-side processing.