JWT Decode
Paste a JSON Web Token to inspect its header and payload locally. Useful for debugging auth flows — not for verifying trust.
Runs in your browser · nothing uploaded
Decode only — signature is not verified. Treat tokens as sensitive.
How to use this tool
- Paste or type your input in the tool above.
- Run the action and inspect the output.
- Copy the result — nothing was uploaded.
Details
JWTs are three Base64URL segments separated by dots. DevKit decodes the first two into readable JSON so you can check claims like `exp`, `sub`, or custom fields while building an API.
Signature verification requires the issuer's key material and belongs in your backend. This page intentionally stops at decode.
Frequently asked questions
- Does this verify the signature?
- No. It only Base64URL-decodes the header and payload for inspection. Never trust a JWT without proper server-side verification.
- Does my token leave the browser?
- No. Decoding runs locally. Still avoid pasting production tokens into any tool you do not trust.
- Why did decode fail?
- The token may be truncated, use a non-standard encoding, or include invalid JSON in a segment.