JWT Decoder

Paste your JWT into the input field and it decodes instantly, showing the header, payload, and signature as formatted JSON. The header reveals the signing algorithm (HS256, RS256, etc.) and token type. The payload contains the claims — issuer, subject, audience, expiration, and any custom data. DevBolt's decoder color-codes the three JWT sections (header.payload.signature) and automatically converts Unix timestamps to human-readable dates. No server calls are made — decoding happens entirely in your browser, making it safe for tokens containing user data.

It depends on the tool. DevBolt's JWT Decoder runs entirely client-side — your token never leaves your browser and no API calls are made. You can verify this in your browser's Network tab. This makes it safe for decoding production tokens. However, server-based JWT decoders send your token to a remote server for processing, which could expose the payload contents including user IDs, emails, roles, and permissions. Always check whether a tool is client-side before pasting sensitive JWTs. Note that JWT payloads are only Base64-encoded, not encrypted — anyone with the token can read the payload.

HS256 (HMAC-SHA256) uses a single shared secret key for both signing and verification. It is simpler but requires distributing the secret to every service that needs to verify tokens. RS256 (RSA-SHA256) uses asymmetric cryptography — a private key signs tokens and a public key verifies them. RS256 is preferred for distributed systems because only the auth server needs the private key while any service can verify tokens using the freely shareable public key. HS256 is faster and suitable for single-service applications. Most modern auth providers (Auth0, Okta, Firebase) default to RS256.

Look at the 'exp' (expiration) claim in the decoded payload. This value is a Unix timestamp representing when the token expires. DevBolt's decoder automatically converts this to a readable date and highlights whether the token is currently valid or expired. You can also check the 'iat' (issued at) and 'nbf' (not before) claims. In code, compare the exp value against the current Unix time: if Date.now() / 1000 > exp, the token has expired. Always validate expiration server-side — never trust client-side checks alone for security decisions.