How to Decode JWT Tokens

Aug 16, 2026

Decode header and payload locally, confirm expiry claims, and never upload production tokens.

Decode without uploading

Paste a token into the JWT Decoder . Header and payload are decoded with Base64URL. The signature is only reported as present or missing. DNVERSE does not receive the token text.

What to look at

alg tells you the signing algorithm. none is not acceptable in production.
exp and iat are Unix timestamps. Convert them with the timestamp converter .
Custom claims are application-specific. Do not assume a role claim is enforced unless the API checks it.

What decoding cannot do

It cannot prove the token is valid. Verification needs the correct key and belongs in your API. A decoder is a reading aid.

If a segment will not decode, the token may be truncated or not a JWT. Compare with Base64 encoding .