DevToolMage

Tokens

JWT Decoder

Read the header and payload of a compact JWT. Decoding is not verification. A decoded token is not proven authentic.

This tool can receive sensitive values. Processing stays in your browser. Do not paste production secrets, private keys, or live access tokens. DevToolMage does not upload or log the input.

Not verified

Decoded only. This is not signature verification and not proof that the token is authentic, trusted, or unexpired.

Error: Input is empty.

How it works

Splits on dots, Base64URL-decodes header and payload, and parses JSON. The signature is displayed as raw text only.

Input and output

Input is a compact JWT string. Output is header JSON, payload JSON, claim notes, and an explicit not-verified state.

Examples

Standard claims

iat, exp, and nbf are shown as timestamps and as readable UTC times when they are numbers.

Malformed token

Fewer than three parts, bad Base64, or invalid JSON produces an error, not a fake success.

How to use this tool

  1. Paste a compact JWT (three Base64URL parts).
  2. Read the header, payload, and claim notes.
  3. Treat every claim as unverified.

Limitations

  • Does not verify HMAC, RSA, or ECDSA signatures.
  • Does not implement JWKS lookup.
  • Does not generate or sign tokens.

Questions

Does this verify the signature?

No. It never asks for a secret or public key and never claims a token is authentic.

What about alg none?

The header is shown as-is. alg none is flagged. The token is still only decoded, not trusted.

Should I paste a live access token?

Prefer a redacted or expired sample. The tool does not upload the token, but screens, extensions, and clipboards still can leak it.

Related tools