JWT decoder
Paste a JWT: the header and payload are decoded and pretty-printed, with issued-at and expiration times shown as readable dates and a warning if the token has expired.
What's inside a JWT
A JSON Web Token has three parts separated by dots: the header (the signing
algorithm, such as HS256 or RS256), the payload (the "claims": who you are,
when the token was issued, when it expires) and the signature. The first two
parts are just Base64URL — not encrypted. Anyone who receives the token can read them, and
that's exactly what this tool does. The time-based claims iat (issued at),
exp (expires at) and nbf (not valid before) are Unix timestamps in
seconds: here they're converted to readable dates in your local time zone.
Heads up: this tool does not verify the signature
Decoding is not the same as validating: verifying the signature would require the secret key or the issuer's public key, which this tool doesn't have and never asks for. A token that decodes cleanly can still be forged or tampered with — signature verification always belongs on the server. One more important tip: don't paste sensitive production tokens (active sessions, API keys). Even though nothing here leaves your browser, a valid token pasted around is like a password written on a sticky note. Use test tokens or ones that have already expired.