JWT Decoder
Paste a JSON Web Token and see the header and payload decoded, with time claims already rendered as readable dates. The tool highlights whether the token is expired, how long it has left, and which algorithm it declares.
# processed in your browser. no request leaves this page.
How it works
A JWT is three dot-separated parts — header, payload and signature — each in URL-safe Base64. This tool decodes the first two. The signature is not verified, because that needs the secret key, which you should never paste into any website.
- Header and payload decoded, with URL-safe Base64 handled properly
- iat, exp and nbf claims rendered as readable dates with time remaining
- Clear warning when the token is expired or not yet valid
- Alert when the declared algorithm is none, a known attack vector