Security
JWT Decoder
Inspect JWT headers and payloads in your browser. Everything happens on this device.
Tip: press Ctrl/⌘ + Enter
Your input stays private
This tool runs entirely in your browser. DevCalc does not send or store the content you enter.
How to use JWT Decoder
- Paste a three-part JSON Web Token.
- Run the decoder to inspect header and payload JSON.
- Verify signatures in your application before trusting any claim.
Example and important notes
Decoding can reveal issuer, audience, subject, and expiration claims while diagnosing authentication behavior.
- Decoding does not verify the signature.
- Treat live JWTs as credentials and avoid sharing them.
Frequently asked questions
Can DevCalc tell whether a JWT is valid?
No. Validity requires signature verification and claim checks using trusted configuration.
Why is the signature not shown as JSON?
The third section is cryptographic signature data, not a JSON document.