JWT Decoder
Paste a JSON Web Token to inspect its header and payload. Standard time claims (exp, iat, nbf) are shown as readable dates, and expiry is flagged. The signature is not verified — this is a decoder, not a validator.
Frequently asked questions
Is the signature verified?
No. Decoding only reads the Base64URL-encoded header and payload. Verifying the signature requires the secret or public key and should be done server-side.
Are my tokens safe here?
Yes — decoding happens entirely in your browser and nothing is transmitted or stored.