Decode a JWT without uploading it
Read the header, payload, common claims, and time-based status. Decoding deliberately does not claim to verify the signature.
The token is decoded in this tab and is not uploaded or saved by DevBox.
Read claims without confusing decoding with trust
A compact JWT contains a Base64URL header, a Base64URL payload and a signature segment separated by dots. Decoding the first two parts reveals their JSON; it does not establish that the signature is correct or the claims should be trusted.
Use this inspector for debugging and understanding a token. Production authentication code must verify the signature and enforce the expected algorithm, issuer, audience, expiration and not-before rules.
JWT decoder questions
What does a JWT decoder show?
A JWT decoder makes the Base64URL-encoded header and payload readable. DevBox also labels common claims such as issuer, subject, audience, issued-at, not-before and expiration.
Does decoding verify a JWT signature?
No. Decoding requires no key and does not prove the token is authentic. The application accepting a JWT must verify its signature, expected algorithm, issuer, audience and timing claims with trusted configuration.
Is it safe to paste a JWT here?
The decoder runs locally in your browser and DevBox does not upload or save the token. JWTs can contain personal data or grant access, so avoid sharing one in screenshots, support reports or other public places.
How does DevBox decide whether a token is expired?
It compares numeric exp and nbf claims, expressed as Unix seconds, with the current time in your browser. That timing indicator is informational and does not replace server-side signature and claim validation.