Is it safe to paste my JWT here?

Yes. Decoding happens entirely in your browser. However, if your JWT contains sensitive claims, be aware that JWTs are only signed, not encrypted — the payload is readable by anyone.

Can this verify the JWT signature?

No. Signature verification requires the signing secret or public key. This tool only decodes and displays the header and payload claims.

How do I check if my JWT has expired?

The decoder reads the exp claim and displays it as a human-readable date, with a clear label indicating whether the token is currently valid or expired.

Best Free Online JWT Decoder

JSON Web Tokens are the backbone of modern API authentication, but their three-part Base64url-encoded format makes them completely opaque without a decoder. devtoolkit.sh's JWT Decoder instantly reveals the contents of any JWT: the algorithm and token type in the header, and all the claims in the payload — including subject (sub), issuer (iss), audience (aud), issued-at time (iat), and expiration (exp). The expiration time is shown in both Unix timestamp and human-readable date formats, and the tool clearly indicates whether the token is currently valid or expired. This is invaluable for debugging authentication issues, verifying what claims your identity provider is actually sending, and checking token lifetimes during development. Since JWTs are not encrypted (only signed), their payload is readable by anyone — and this tool reads it entirely in your browser, with zero data transmitted to any server. Custom claims added by your identity provider or application are also displayed, giving you the full picture of what information a token carries at a glance.

jwt token

lines

0 chars1 lines

Invalid JWT: expected 3 parts separated by dots

FAQ

Is it safe to paste my JWT here?: Yes. Decoding happens entirely in your browser. However, if your JWT contains sensitive claims, be aware that JWTs are only signed, not encrypted — the payload is readable by anyone.
Can this verify the JWT signature?: No. Signature verification requires the signing secret or public key. This tool only decodes and displays the header and payload claims.
How do I check if my JWT has expired?: The decoder reads the exp claim and displays it as a human-readable date, with a clear label indicating whether the token is currently valid or expired.