JWT Decoder
Paste a JSON Web Token to see its header and payload as formatted JSON, with the exp, iat and nbf times converted to dates and an expiry status. Your token stays in this tab only.
Decoding does not verify the signature. Anyone can create a token with any payload. Always verify JWTs on your server with the correct key before trusting them. Your token is decoded on this device, never sent anywhere and never saved.
How to decode a JWT
- Paste the token (with or without the 'Bearer ' prefix).
- Read the decoded header and payload.
- Check the expiry, issued-at and not-before times.
- Copy the header or payload JSON.
Frequently asked questions
Does this verify the token's signature?
No. Decoding only reads the Base64URL-encoded header and payload, which anyone can do. It does not prove that the token is genuine or unaltered. Always verify signatures on your server with the correct key.
Is it safe to paste a production token here?
DevKOM decodes the token in your browser, never sends it anywhere and never saves it, not even in local storage. Still, treat live tokens like passwords and prefer expired or test tokens.
Can it decode encrypted JWTs (JWE)?
No. JWE tokens have five parts and an encrypted payload that needs the key. The decoder recognises them and tells you.
Related tools
- Base64 Encoder / DecoderEncode and decode Base64 with full UTF-8 support.
- Unix Timestamp ConverterConvert epoch seconds or milliseconds to dates and back.
- JSON FormatterPretty-print or minify JSON with clear error locations.
More in Encoding & Security.