JWT Decoder
Decode and inspect JSON Web Tokens client-side
About JWT Decoder
How JWT Decoder Works
Splits compact JSON Web Tokens into JOSE header, payload claims, and signature per IETF RFC 7519 and Base64URL RFC 4648. Expiration timestamps (exp, iat, nbf) are evaluated locally, ensuring confidential authentication credentials and OAuth tokens are never transmitted across the network.
The JWT Decoder lets you inspect JSON Web Tokens by splitting them into their header, payload, and signature parts and decoding the Base64 sections into readable JSON. A typical use case is checking what claims an authentication token actually contains and whether it has expired, without trusting a black-box library. Everything is decoded locally, so tokens are never sent to a server, which matters because tokens often grant access to user accounts. You can verify expiry timestamps, issuer fields, and custom claims at a glance. This is invaluable when debugging login flows, OAuth callbacks, or microservice authorization where a misconfigured claim silently breaks access.
Frequently asked questions
Does it verify the signature?+
No. It decodes and displays claims; signature verification requires the secret key.
Is it safe to paste tokens?+
Yes, decoding happens in your browser and nothing is transmitted.
How do I check expiry?+
Look at the exp claim, which is a Unix timestamp compared against the current time.
Limitations
It cannot validate signatures or confirm a token is trusted. Never paste production tokens into untrusted third-party sites.