DevTilt

JWT Decoder

Paste a JWT to inspect header and payload locally. Check expiry and common claims. Decoding does not prove the signature is valid.

Paste a JWT to inspect header and payload locally.

How to decode a JWT

  1. Paste a token in header.payload.signature form.
  2. Decode runs as you type, or press Ctrl+Enter (Cmd+Enter on Mac).
  3. Inspect header JSON, payload JSON, and exp/nbf/iat when present.
  4. Copy payload JSON if needed. This page does not verify signatures.

What is JWT Decoder?

JWTs carry authentication claims in a Base64-encoded header and payload that look opaque in a log line. This decoder splits the three segments, shows the JSON header and payload, and displays the signature — without verifying it, so you can inspect tokens from any source safely in the browser.

Why use DevTilt's JWT Decoder?

  • Splits header, payload, and signature segments
  • Pretty-prints JSON claims and algorithm metadata
  • Shows token expiration (exp) and issued-at (iat) claims
  • Decode only — no secret required, no server verification

Common use cases

  • Inspecting claims in an OAuth access token during API debugging
  • Checking token expiration before a 401 error appears
  • Reading the algorithm and key ID from a JWT header
  • Verifying what scopes or roles a token actually contains

FAQ

No. This tool only Base64URL-decodes the header and payload. A readable token is not a trusted token. Signature verification is a separate step and is not included here.
When present as numeric Unix timestamps, the tool shows absolute UTC time and a relative phrase such as “expires in 12m” or “expired 3h ago”. Color alone is not the only signal.
No. Decoding runs entirely in your browser. Tokens are not sent to a server, logged, or persisted.
A JWT must be header.payload.signature with dots separating exactly three Base64URL segments. Missing dots, extra segments, or pasted Bearer prefixes can trigger this error.
Yes. Expiry only affects whether the token should be trusted at runtime — decoding still shows header and payload so you can inspect claims and exp timestamps.