Is it safe to paste my JWT here?

Yes. All processing happens entirely in your browser. No data is sent to any server. However, avoid sharing JWTs in screenshots or public channels.

Can DevDash verify the JWT signature?

DevDash decodes and displays the JWT but does not verify signatures, as that requires the signing secret or public key which should remain on your server.

What does the exp claim mean?

The exp (expiration time) claim is a Unix timestamp indicating when the token expires. DevDash shows whether it is expired and, if still valid, how much time remains.

Why are there three colored sections?

A JWT has three Base64URL-encoded parts: header (blue, contains algorithm), payload (green, contains claims), and signature (red, cryptographic verification). They are separated by dots.

JWT Decoder

Security Tools

Decode and inspect JSON Web Tokens with expiry status

By DevToolHQ teamUpdated 2026-04-15100% client-sideMethodology

100% client-side processing

Paste JWT

About JWT Decoder

JWTs (JSON Web Tokens) consist of three Base64URL-encoded sections separated by dots: a header containing the algorithm, a payload containing the claims, and a signature for verification. This tool decodes the header and payload sections and displays them as formatted JSON, making it easy to inspect the contents of any JWT without writing code. The header typically contains the algorithm (alg) — HS256, RS256, ES256 — and the token type. The payload contains the actual claims: the subject (sub), issuer (iss), audience (aud), expiration time (exp), and any custom claims your application adds. The tool parses the exp and iat (issued at) claims as timestamps and shows them as human-readable dates, and indicates whether the token is currently valid or expired — useful for debugging authentication issues where a token looks correct but is being rejected. Important limitation: this tool decodes but does not verify. Verifying a JWT signature requires the secret key (for HMAC algorithms like HS256) or the public key (for RSA and EC algorithms like RS256, ES256). Signature verification must happen server-side. Decoding alone is sufficient for inspecting claims during development and debugging — but never trust a decoded JWT's claims in production code without verifying the signature first.