JWT Decoder
Decode & inspect JSON Web Tokens — locally
Runs in your browser
Paste a JWT to decode its header and payload.
Your token never leaves your device — it is decoded entirely in your browser, never uploaded or logged.
About
A JWT is just three Base64url segments — a header, a payload, and a signature — and the first two are plain JSON hiding in plain sight. Devbelt decodes them as you type, pretty-prints both with full syntax highlighting, and translates the standard claims like exp and iat into readable dates so you can tell at a glance whether a token is still valid. It never asks for your secret and never uploads the token — unlike online decoders that quietly send your production credentials to their server.
Frequently asked questions
How do I decode a JWT?
Paste the token into the box. Devbelt splits it at the dots and decodes the header and payload from Base64url into readable JSON instantly — no button needed.
Is it safe to decode a JWT online?
Only if the tool is genuinely local. Devbelt decodes entirely in your browser and never uploads or logs your token, so even a production token stays on your machine. Be wary of decoders that send tokens to a server.
Does this verify the signature?
No, and that is deliberate. Verifying a signature requires the secret (HS256) or public key (RS256), and asking for your secret is exactly what a privacy-first tool should not do. Devbelt shows the signature but leaves verification to your own trusted environment.
How do I know if a token is expired?
Devbelt reads the exp claim and shows the expiry date in plain English with an “Expired” or “Active” badge, so you never have to convert a Unix timestamp by hand.
What are exp, iat and nbf?
They are standard JWT time claims: iat is when the token was issued, nbf is the earliest time it is valid, and exp is when it expires. Devbelt converts all three from Unix timestamps into readable local times.