JWT Decoder
Inspect the claims in an access or ID token while debugging authentication. The token is decoded on this page and never sent anywhere. This tool does not verify signatures, so never trust a token just because it decodes.
Runs entirely in your browser. Your input and files are not uploaded to any server.
How to use
- Paste a JWT (three Base64URL parts separated by dots).
- Read the decoded header and payload.
- Check exp, iat and nbf, shown in UTC and local time, with a warning when the token has expired.
Examples
If exp is in the past, the tool shows “Expired” with how long ago.
Privacy
Your files and text stay in your browser while you use this tool, and ads or anonymous visit statistics do not receive them. Only your favorites and recent tools are saved on your device. Privacy policy
Want proof? Check it with your browser’s Network tab: How to check that a tool does not upload your files
Frequently asked questions
Does it verify the signature?
No. Verifying needs the secret or the public key of the issuer, and should be done by your server. Decoding only shows what the token claims.
Is it safe to paste production tokens?
The token stays in this page and is not stored or transmitted. Still, treat live tokens like passwords and prefer expired or test tokens when you can.