DYDevKitYard
← Code tools

Code Tool

JWT Decoder

Decode JSON Web Tokens locally to inspect the header, payload claims, signature presence, issuer, subject and expiry timing while debugging authentication flows.

Decode a JWT

Paste a JSON Web Token to decode the header, payload and signature locally in your browser.

StatusValid JWT structure

This token does not appear expired. Expires at May 18, 2033, 3:33:19 AM.

AlgorithmHS256
TypeJWT
ExpiryNot expired
Signature chars16
Issued atJun 1, 2024, 12:00:00 AM
Not beforeJun 1, 2024, 12:00:00 AM

Your JWT is decoded in your browser and is not uploaded.

Decoded token

Review the decoded header, payload claims, signature and timing values.

Header

Header details

Algorithm: HS256. Token type: JWT.

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

Payload details

Expires: May 18, 2033, 3:33:19 AM · Issued at: Jun 1, 2024, 12:00:00 AM · Not before: Jun 1, 2024, 12:00:00 AM · Status: does not appear expired

{
  "name": "DevKitYard",
  "role": "admin",
  "iat": 1717200000,
  "nbf": 1717200000,
  "exp": 1999999999
}

Signature

Signature sectionsample-signature

Full decoded JSON

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "name": "DevKitYard",
    "role": "admin",
    "iat": 1717200000,
    "nbf": 1717200000,
    "exp": 1999999999
  },
  "signature": "sample-signature",
  "claims": {
    "algorithm": "HS256",
    "tokenType": "JWT",
    "expiresAt": "May 18, 2033, 3:33:19 AM",
    "issuedAt": "Jun 1, 2024, 12:00:00 AM",
    "notBefore": "Jun 1, 2024, 12:00:00 AM",
    "expired": false
  }
}

How to Use JWT Decoder

  1. Paste a JWT into the decoder input.
  2. Decode the token to inspect the header, payload and signature segment.
  3. Review claims such as issuer, subject, audience, issued time and expiry.
  4. Copy the decoded JSON when you need it for debugging or documentation.

FAQ

Does this verify the JWT signature?

No. It decodes token parts for inspection only. Signature verification requires the correct secret or public key.

Is it safe to paste a JWT here?

The token is decoded locally in your browser, but you should still avoid sharing active production tokens unnecessarily.

Can I see token expiry?

Yes. Standard timing claims such as exp and iat are converted into readable dates where possible.

What JWT formats are supported?

The tool supports standard three-part JSON Web Tokens using Base64URL encoded header, payload and signature segments.