Home › JWT decoder
JWT decoder
Decode JWT headers and payloads, see issued and expiry times in your timezone, and check if a token has expired — without sending it anywhere.
🔒 Runs 100% in your browser — safe for real dataHeader
Payload
The signature is not verified — decoding only. Never paste production secrets into sites that send data to a server; this one does not.
How to use the jWT decoder
- Paste a JWT (with or without “Bearer ”).
- Read the decoded header and payload.
- Check the expiry status in the summary table.
About this tool
A JSON Web Token has three Base64URL-encoded parts: a header (algorithm and type), a payload (claims such as sub, iat and exp) and a signature. This decoder shows the first two as formatted JSON and converts timestamps to readable dates. Because it runs locally, it is safe to paste real access tokens.
FAQ
Is my data sent to a server?
No. DevKnife tools run entirely in your browser with JavaScript. Nothing you paste — API keys, tokens, customer data — is transmitted or logged, so it is safe for production data.
Does this verify the signature?
No — verifying requires the secret or public key. Decoding only shows what the token claims; never trust a token without verifying it on your server.