Devsdesk
← All tools

JWT Decoder

Decode JWT headers and payloads locally, your token is never sent anywhere.

Paste a JSON Web Token to inspect its header and payload. All decoding happens in your browser; tokens are not logged or transmitted. We never verify signatures here, signature verification needs your secret, which should never leave your servers.

Your token is decoded entirely in your browser and never sent to a server. We do not verify signatures, that requires your secret, which should never leave your servers.
{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "sub": "1234567890",
  "name": "DevsDesk",
  "iat": 1700000000,
  "exp": 9999999999
}
Issued at2023-11-14T22:13:20.000Z
Expires2286-11-20T17:46:39.000Z
StatusValid (not expired)

FAQ

Is my token sent to a server?

No. We decode tokens entirely client-side. A token is just three base64-encoded JSON blobs joined by dots.

Why don't you verify signatures?

Verifying a signature requires the signing secret. You should never paste that into a website, verify on your own server instead.

Related tools