JWT Decoder & Inspector
Decode the header and payload of a JWT and check its expiry. The token never leaves your browser. All processing happens in your browser; your input is never sent to the server.
A JWT is three base64url segments joined by dots: a header describing the algorithm, a payload carrying the claims, and a signature. The first two are only encoded, not encrypted — anyone holding the token can read them. This decoder shows you exactly what a token is carrying and whether it has expired, without sending it anywhere.
How to use it
- Paste the whole token, including both dots. Leading "Bearer " is fine to remove first.
- The header and payload appear as formatted JSON as soon as the token parses.
- If the payload has an exp claim, the tool converts it to a real date and tells you whether the token is still valid.
- Read the claims you care about: sub for the subject, iat for issue time, aud for audience, scope or roles for permissions.
Frequently asked questions
- Does this verify the signature?
- No, and that is deliberate. Verifying requires the secret or public key, and you should never paste a signing secret into a web page. This tool decodes and inspects; verification belongs in your backend.
- Is it safe to paste a real token here?
- The token never leaves your browser — decoding is pure JavaScript on this page. That said, a JWT is a credential; treat it like a password and avoid pasting production tokens into any tool you have not audited.
- Why does my token show as expired when it works?
- exp is in seconds since the Unix epoch and is compared against your device clock. If your system time is wrong, the verdict will be wrong too.
- Can I edit the payload and re-sign it?
- Not here. Changing the payload invalidates the signature, and producing a new valid signature requires the key. That is the entire point of the format.