Decode JWT header and payload, inspect expiration data, or create HS256 tokens locally. Decoding does not verify that a token signature is valid.
A JWT can be decoded because its header and payload are Base64URL-encoded; that does not prove the signature is trustworthy. DevPayload keeps this distinction explicit while letting you inspect token contents without sending them to the server.
This public tool runs in your browser. Its input is not written to the DevPayload database.
No. Decoding only reads the encoded header and payload. Signature verification is a separate cryptographic operation.
No. Normal JWT decode and HS256 encode operations run locally in your browser, and the secret is kept in memory only.
No. Public deterministic tools work without signing in.
