JWT Decoder
Decode a JSON Web Token's header and payload instantly and inspect expiry. Your token is decoded locally in the browser and never leaves your machine.
🔒 Runs entirely in your browser — no data is ever sent anywhereFrequently asked questions
Is it safe to paste a real JWT into this tool?
Decoding happens entirely client-side — the token never touches a server. That said, JWTs often contain sensitive claims, so treat any tool (including this one) with the same care you'd use for other credential data.
Does this verify the token's signature?
No — this tool only decodes the header and payload, which are just Base64-encoded JSON and readable by anyone without a key. Verifying the signature requires the issuer's secret or public key, which this tool never asks for or has access to.
Why does it say my token is expired?
The payload's 'exp' claim is a Unix timestamp for when the token expires. This tool compares it against your current system clock — if your device's clock is wrong, expiry status may be misleading.