JWT Decoder
Read claims and timestamps, then optionally check a pasted signing key.
Runs in your browser. Nothing is uploaded.
Verify signature
Decoding is not verification
Anyone can decode a JWT. The header and payload are only encoded, not encrypted. If you paste a secret or PEM public key, this page checks that key against the original signature in your browser. It does not re-sign the token or fetch JWKS. A matching signature is still not a grant of access. Your API must verify tokens itself.
exp, nbf, and iat are shown as UTC time next to the raw unix seconds. Do not paste production tokens into tickets, screenshots, or chat.
Reading the standard time claims
exp is the time after which a token should not be accepted. nbf is the time before which it should not be accepted, and iat is the time at which it was issued. These values are usually Unix seconds, not milliseconds. The decoder shows the number and a UTC date so an obvious unit mistake is easier to spot. Your server still decides which claims are required and how much clock skew it allows.
A readable date is not evidence that the token came from your identity provider. A token can contain a future expiration, a missing expiration, or a claim with the wrong type. Treat every value as untrusted until the receiving service verifies the signature and applies its own authorization rules.
Algorithms and signatures
The header names the signing algorithm in alg. This page highlights alg: none because a token without a signature cannot establish who created it. Local verification supports HMAC (HS256/384/512), RSA (RS256/384/512 and PS256/384/512), and ECDSA (ES256/384/512) with a key you paste. Other algorithm names stay labels only. The page never re-signs the token to make a wrong key look valid.
Never paste a production token into a bug ticket, chat, or screenshot. Even a token that will expire soon may authorize a real account. If you need to share a reproduction, create a fixture with fake claims and a fake signature. The guide JWT decoded vs verified explains the boundary between inspection and trust.
Local inspection with clear limits
JWT parts are split, Base64url-decoded, and parsed in your browser. The signature part is shown as opaque text because decoding it does not validate it. Nothing is sent to TheDevTab, and the page does not contact an issuer or introspection endpoint. This makes the page useful for inspecting a sample in your browser, but it does not replace your security tests.
Use JSON Formatter if you need to inspect a copied claims object after decoding. For a raw exp or iat value, the Unix Timestamp tool can show the same UTC interpretation.
FAQ
Where does the signing key go when I verify a JWT?
The decoder does not need a key to read the header and payload. If you open Verify signature and paste an HMAC secret or a BEGIN PUBLIC KEY PEM, Web Crypto uses it in your browser; the key and token are never uploaded.
Is decoding the same as verifying a JWT?
No. Decoding reads the header and payload, while verification checks the original signature against a key you provide. A matching signature still does not validate issuer, audience, expiry policy, or authorization decisions for your API.
Why do you warn about alg none?
alg none means the token has no signature to verify. Its claims can be changed without a signing key, so the warning prevents a decoded token from being mistaken for a trusted one.
Is it safe to paste a production token?
The token is processed in your browser and never leaves your browser, but it is still a credential on your screen. Avoid putting production tokens in screenshots, tickets, chat, or copied logs.
What do exp, nbf, and iat mean?
exp is the expiration time, nbf is the not-before time, and iat is the issued-at time. The decoder treats numeric values whose absolute value is below 1e12 as Unix seconds, flags larger values as likely milliseconds, and shows an ISO UTC date.
Can this decoder tell me if a JWT is valid?
It can decode the three parts and locally check a signature when you provide a supported HMAC secret or RSA or ECDSA public key. It does not fetch JWKS, re-sign the token, or enforce issuer, audience, or authorization policy, although it does display exp and nbf timing warnings.