Decode JWT header and payload in your browser.
This tool decodes tokens locally for inspection. It does not verify signatures or prove that a token is trustworthy.
Workspace
Decoded locally. Signature is not verified.
Expired. This token expired at 6/6/2024, 12:00:00 PM (2024-06-06T12:00:00.000Z).
Paste a JWT to decode its parts locally.
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "Dev Atlas",
"iat": 1717588800,
"exp": 1717675200
}Time claims
Token statusExpired
iat6/5/2024, 12:00:00 PM (2024-06-05T12:00:00.000Z)
nbfNot present
exp6/6/2024, 12:00:00 PM (2024-06-06T12:00:00.000Z)
About this JWT decoder
Use this JWT decoder to inspect token headers, payload claims, and timestamp fields during authentication debugging. It decodes locally and does not verify signatures.
Common use cases
- Check exp, iat, and nbf claims while debugging login sessions.
- Inspect token scopes, audiences, issuers, and custom claims.
- Review JWT contents without sending the token to a remote service.
How to use this tool
- Paste a three-part JWT into the input field.
- Review the decoded header, payload, and token status.
- Use the time claims panel to check issued-at, not-before, and expiration values.
Example
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMifQ.signature
Output
{
"alg": "HS256",
"typ": "JWT"
}
{
"sub": "123"
}Common errors
- A JWT must have exactly three dot-separated parts: header, payload, and signature.
- Invalid base64url content usually means the token was copied incompletely or modified.
- Decoded claims are not proof of trust because this tool does not verify the signature.
Privacy note
Dev Atlas keeps this tool local in your browser. Your input is not intentionally uploaded to a Dev Atlas server for processing.
FAQ
Does this validate the JWT signature?
No. It only decodes the header and payload locally.
Should I paste production tokens?
Avoid pasting secrets into any website. This tool runs locally, but cautious handling is still best.
Why are exp and iat shown as dates?
JWT time claims are Unix seconds, so the decoder converts them into readable local and UTC dates.