Input
Preparing your workspace…
How to use
- Paste a three-part token, with or without a Bearer prefix.
- Inspect the decoded JSON and claim dates.
- Copy a JSON section or download the decoded token data.
What JWT decoding tells you
The header and payload of a compact JWS token contain Base64url-encoded data. Decoding makes that data readable without obtaining a signing key.
Readable claims are not proof of authenticity. Use the decoded fields to investigate token shape and timing, then verify trust and application requirements in the system that consumes the token.
Reading the token parts
The header can identify the claimed algorithm, and the payload contains the claims. The signature segment remains encoded; displaying it does not establish who signed the token.
NumericDate claims such as exp, nbf and iat are shown against UTC and the browser’s local time. Expiry indicators compare dates rather than validate token trust.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJkZXYtMTIzIiwibmFtZSI6IkFkYSIsInJvbGUiOiJkZXZlbG9wZXIiLCJpYXQiOjE3NjcyMjU2MDAsImV4cCI6MTc5ODc2MTYwMH0.ZGVtby1zaWduYXR1cmU{"sub":"dev-123","name":"Ada","role":"developer","iat":1767225600,"exp":1798761600}Example data only. Values, authentication and endpoint behavior must be checked in your own context.
Formats and verification
Five-part encrypted JWE tokens are outside this decoder. It does not fetch signing keys, contact the issuer or perform signature verification, including when the header names a recognized algorithm.
Exporting decoded data
Copy exports the selected header or payload JSON; Download JSON includes the decoded sections and encoded signature. Treat exported claims with the same care as the original token.
Local tools accept up to 1 MiB, URLs up to 64 KiB, and have a 5-second processing limit. API requests support 100 headers and 100 parameter rows, a 1–120 second timeout and up to 5 MiB of received response data. Long text previews are abbreviated. Requests go directly to your chosen endpoint; CORS and browser policy apply.
Frequently asked questions
Does decoding verify the signature?
No. A modified or untrusted token can still decode. The consuming application must verify its signature and the claims required by that application.
What do exp, nbf and iat mean?
They are NumericDate values in Unix seconds: expiration, not-before and issued-at. Their displayed dates are useful for investigation, not a verification verdict.
Can I paste a Bearer header value?
Yes. The decoder accepts a pasted Bearer prefix before the compact token.
Can it decrypt an encrypted JWT?
No. Five-part JWE tokens require decryption and are not supported by this three-part JWS decoder.
Is the token sent to its issuer or DevToolsy?
No. Decoding runs locally, without contacting the token issuer or requesting signing keys.