1
Paste Token
Enter a JWT (three Base64URL segments separated by dots) into the input area.
JWT Decoder
Decode JWT header and payload. View standard claims (iss, sub, aud, iat, exp, nbf) and expiration status. Works entirely in your browser — no signature verification, no secrets required.
Your data stays in your browser.
The JWT is processed locally and is not uploaded to DevPouch.
JWT Input
0Characters
0 BSize
Paste a JWT (three Base64URL segments separated by dots).
Awaiting input…
Error
-
Decoded Output
Header (Algorithm & Type)
Payload (Data & Claims)
How it works
2
Inspect Claims
View the decoded header (algorithm, type) and payload (standard & custom claims) instantly.
3
Verify Expiration
Check the exp claim timestamp and see if the token is expired or still valid.
Technical Deep Dive: JWT Structure
Header
Determines the signing algorithm (e.g., HS256, RS256, ES256) and token type (JWT).
{
"alg": "HS256",
"typ": "JWT"
}Payload
Contains the assertions (claims) about the entity. Standard claims include iss, sub, aud, iat, exp, nbf.
{
"iss": "https://api.example.com",
"sub": "user_12345",
"aud": "client_app",
"iat": 1700000000,
"exp": 1700086400,
"nbf": 1700000000,
"role": "admin"
}Signature
The cryptographic hash used to verify integrity. This tool is client-side and does not verify the signature.
// HMAC SHA256 example
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
secret
)Standard Claims Reference
| Claim | Name | Description | Type |
|---|---|---|---|
exp |
Expiration Time | Identifies the expiration time on or after which the JWT MUST NOT be accepted for processing. | NumericDate (Unix timestamp) |
iat |
Issued At | Identifies the time at which the JWT was issued. | NumericDate (Unix timestamp) |
nbf |
Not Before | Identifies the time before which the JWT MUST NOT be accepted for processing. | NumericDate (Unix timestamp) |
iss |
Issuer | Identifies the principal that issued the JWT. | String or URI |
sub |
Subject | Identifies the principal that is the subject of the JWT (typically a user ID). | String or URI |
aud |
Audience | Identifies the recipients that the JWT is intended for. | String, URI, or array |
Frequently Asked Questions
- No. This tool only decodes the Base64URL-encoded header and payload. It does not validate the cryptographic signature, and no secret or public key is required. All processing happens locally in your browser.
- Yes. The payload is still readable even if the
expclaim is in the past. The tool will decode the token and indicate that it is expired, but the claims remain accessible. - No. All processing happens entirely in your browser. The token never leaves your device and is never uploaded to DevPouch or any other server.
- When present, the tool shows
iss(issuer),sub(subject),aud(audience),iat(issued at),exp(expiration), andnbf(not before). Custom claims are also displayed in the payload output. - Yes. Each section has its own Copy button to copy the formatted JSON to your clipboard.
- Once the page is loaded, the tool works offline because all logic runs client-side.
A JSON Web Token (JWT) Decoder lets developers inspect the header and payload of any JWT without needing a secret key. Because JWTs are base64url-encoded rather than encrypted, anyone holding the token string can read its claims. This makes a decoder an essential debugging tool for API authentication, single sign-on flows, stateless session management, and troubleshooting failed authorization in modern web applications. It works entirely client-side, so token data never leaves your browser during inspection.
Use Cases
Debug failed authentication by comparing the token payload against what your backend expects. Verify that role and permission claims are present before granting access to protected routes. Inspect token expiry (exp) and issuance (iat) timestamps to troubleshoot sessions that end too early or last too long. Audit third-party identity providers to confirm the claims they embed match your application contract. Examine the header algorithm (alg) and type (typ) to ensure tokens are signed with the expected method and not handed over unsigned.
- API authentication debugging
- SSO and OAuth claim verification
- Role-based access control audits
- Token expiry and lifecycle troubleshooting
- Header algorithm and type inspection
How-To
Paste a complete JWT into the decoder input field. The tool splits the token at its two dots and base64url-decodes the header and payload segments separately, rendering each as readable JSON. No secret key is required because decoding reveals encoded claims rather than cryptographic proof.
- Copy the full JWT from your browser DevTools, mobile client, or API response.
- Paste the token string into the decoder field.
- Read the decoded header, including the signing algorithm and token type.
- Review the payload claims such as subject, issuer, audience, roles, and expiration.
- Confirm the signature segment remains untouched; the decoder reads claims without verifying cryptographic signatures.
Use the decoded output to correlate token claims with your server-side authorization logic. If a claim is missing or malformed, update your identity provider or token issuance code. Remember that decoding is read-only inspection: never paste production secrets or tokens you do not own into a public decoder, and always verify signatures server-side before trusting any JWT. Treat decoded claims as untrusted input until your authorization layer has validated them.