About this tool
A JSON Web Token (JWT) is a compact, Base64URL-encoded structure used for authentication and authorization. It's made of three parts — header, payload, and signature — separated by dots. This tool decodes the header and payload so you can inspect claims like expiry, issuer, and subject without writing any code.
How it works
- Paste a JWT (the full header.payload.signature string).
- The header and payload are Base64URL-decoded and parsed as JSON.
- If an exp claim is present, the tool tells you whether the token is expired and when.
Frequently asked questions
Does this verify the signature?
No — verifying a signature requires the issuer's secret (HMAC algorithms) or public key (RSA/ECDSA algorithms), which this tool doesn't have. It only decodes and displays the claims; treat any claims as unverified.
Is my token sent to a server?
No — decoding happens entirely in your browser. That said, avoid pasting production tokens with sensitive claims into any third-party tool as a general security habit.