Paste a token — see the header, payload and whether it's expired. It never leaves your browser.
A JSON Web Token is three base64url parts separated by dots: header, payload and signature. This JWT decoder splits it, decodes the first two into readable JSON, and reads the standard claims — exp, iat, nbf, sub, iss — converting the Unix timestamps into real dates so you instantly see whether the token is active, expiring soon, or already expired.
A JWT is a live credential. Pasting a production token into a random website means handing someone a key to your account — and most online decoders send it to their server. This one never does: everything happens in your browser with plain JavaScript. Open the page, turn off your internet, and it still decodes. That's the whole point.
Anyone can decode a JWT — the payload isn't encrypted, only signed, so never put secrets in it. Verifying proves the token wasn't tampered with and needs the key: the shared secret for HS256 or the public key for RS256. Paste an HS256 secret above and this tool checks the signature locally using the browser's Web Crypto API; without a key it honestly reports the signature as unverified.
Related: All free tools