Paste a JWT to inspect header and payload. Decoding is local; the signature is not verified.
—
—
—
A JSON Web Token has three Base64URL parts: header, payload and signature. DevsDrill only decodes the first two in your browser — useful when you need to inspect claims without pasting secrets into a third-party site.
Typical workflows include checking whether exp is in the past, confirming audience or issuer values, verifying that a role claim matches what your API expects, or comparing two tokens after a refresh. Because this page does not verify signatures, it is an inspector, not a security oracle: you still need your signing secret or public key in your own environment to prove authenticity. Use the tool for visibility; keep verification in your auth library or identity provider.
The decoder is free, works offline once the page is loaded, and pairs well with other DevsDrill utilities when you also need Base64 helpers or to diff two claim JSON blobs. Prefer short-lived tokens and avoid sharing screenshots that still contain live secrets. If you only need to understand structure, redact sensitive claim values after decoding locally.
Support tickets often include a token that “should work.” Decoding locally shows whether exp is in the past or whether an audience claim mismatches the API. Pair with Base64 when you need to inspect a single segment manually, and with the diff tool when comparing two claim JSON blobs after a refresh.
Open the JWT decoder during auth bugs: expired sessions, wrong audience, missing roles or opaque tokens from an IdP. It is an inspector for header and payload claims, not a replacement for signature verification in your stack.
No. Verification needs the signing secret or public key. This tool only decodes and displays claims.
No. Everything runs in your browser.
This tool targets compact JWS-style three-part tokens. Encrypted JWE structures need decryption keys and are not handled here.
Usually the string is truncated, not a JWT, or uses a non-JSON payload. Check you pasted the full token with two dots and no extra spaces.
Prefer redacted or short-lived tokens. Never share screenshots that still contain live secrets.
Verification needs your secret or public key. Keeping keys out of a public web page is intentional — decode here, verify in your auth library.
Paste a compact JWT into the input. Click Decode. DevsDrill splits on dots, Base64URL-decodes the first two segments in your browser, pretty-prints header and payload JSON when possible, and shows metadata about claims and the signature segment length. Invalid padding or malformed JSON is reported in the status area. Clear removes the fields from the page.
Your token never leaves the device as part of DevsDrill tool processing. Nothing is uploaded to DevsDrill application servers for decoding. Signature verification is intentionally not performed here, so we also never ask you to paste signing secrets. Treat the on-screen payload as sensitive and clear it when finished.