JWT Decoder

Inspect token structure locally. Decoding reveals claims—it does not verify the signature.

Encoded token

Token text is held in memory only and never persisted or transmitted.

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "dev-42",
  "name": "Ada Lovelace",
  "scope": [
    "read:api",
    "write:code"
  ],
  "iat": 1735689600,
  "exp": 1893456000
}

Signature not verified

This decoder only reads Base64URL segments. Trust claims only after verification with the issuer’s expected algorithm and key.

23 signature bytesc2lnbmF0dXJlLWZvci1kZW…

Time claims

iat: 2025-01-01T00:00:00.000Z
exp: 2030-01-01T00:00:00.000Z

Tool documentation

Decode and inspect JSON Web Tokens locally

Read JWT structure, claims, and time fields without transmitting credentials or bearer tokens to a decoder service.

100% Client-Side

Conversion runs locally in your browser.

No Payload Logging

Your tool input is never uploaded or logged.

Private by Design

Input stays on your device and is not persisted.

How to use

1
Paste the encoded JWT
Add a three-part JSON Web Token to the input panel. Header and payload claims are decoded immediately in this browser tab.
2
Inspect claims and timestamps
Review the algorithm, issuer, audience, subject, scopes, and NumericDate claims such as iat, nbf, and exp when they are present.
3
Verify before trusting
Treat decoded claims as untrusted data until your application verifies the signature, expected algorithm, issuer, audience, and lifetime with the correct key.

Technical details

Decoding is not verification

A JWT decoder can read Base64URL segments without knowing the signing key. Anyone can alter those segments, so readable claims are not proof that the issuer created or approved the token.

Base64URL and JSON parsing

JWT header and payload segments use URL-safe Base64 without required padding. DevCrate normalizes and decodes those segments, then parses their UTF-8 JSON locally.

NumericDate claims

Standard iat, nbf, and exp values are seconds since the Unix epoch. DevCrate displays deterministic ISO timestamps while preserving the original numeric values.

Privacy & security verification

JWT decoding happens entirely in browser memory. DevCrate does not verify against, fetch from, or contact the token issuer, and it does not upload or persist the token. Ordinary static page requests may still be logged by the site host, but they never contain your JWT.