Decode JWT header, payload, and signature, and check expiry.
Your vote is saved on this device only.
Paste any JSON Web Token and instantly see its three parts decoded: the header (algorithm and token type), the payload (claims like subject, issuer, and audience), and the signature. The tool also reads the expiry claim so you can tell at a glance whether a token is still valid or has already lapsed, saving you from manual Base64URL decoding or guesswork while debugging auth flows.
It is built for backend and frontend developers, QA engineers, and anyone inspecting tokens from OAuth, OpenID Connect, or session cookies. Because it runs entirely in your browser, the token you paste never touches a server, so you can safely inspect production credentials. It is free, requires no sign-up, and decodes locally on your machine.
No. All decoding happens locally in your browser, so the token never leaves your machine or reaches a server. This makes it safe for inspecting production or sensitive tokens.
It decodes and displays the signature segment, but decoding a token does not cryptographically verify it. Verification requires the signing secret or public key, which you should validate in your own backend.
JWT segments are Base64URL-encoded, not encrypted. The decoder reverses that encoding to reveal the JSON header and payload in plain text.
The tool reads the exp claim, a Unix timestamp in the payload, and compares it to the current time to report whether the token has expired.
Yes. It handles standard JWTs regardless of issuer, including those from OAuth, OpenID Connect, and custom auth systems, as long as they follow the header.payload.signature format.