JWT Decoder
Decode a JSON Web Token's header and payload in your browser, with expiry check. The token never leaves your machine — which matters, because JWTs are credentials.
Private by construction. The conversion happens in this page's JavaScript. Nothing you paste here leaves your machine, and the tool keeps working with the network unplugged.
Splits a JSON Web Token into its header and payload and shows both as formatted JSON, plus a human-readable expiry check when the token carries an exp claim. This runs entirely in your browser, and for a JWT that is not a nicety — a live token pasted into a server-side decoder is a leaked credential. One honest limit: this tool decodes, it does not verify. Checking the signature requires the signing key, which your browser does not have and this site would never ask for.
Questions this tool gets asked
Is it safe to paste a real token here?
The token is processed by JavaScript in this tab and never transmitted. That said, treat live production tokens like passwords anywhere: decode expired or test tokens when you can.
Why doesn't this verify the signature?
Signature verification requires the secret or public key the token was signed with. A decoder without your key can only inspect contents; any online tool claiming to 'verify' without a key is only checking the format.
What does the expiry line mean?
If the payload has an exp claim (a Unix timestamp), the tool converts it to a date and says whether the token is still valid or how long ago it expired.