JWT Decoder

A JSON Web Token is three Base64 segments separated by dots: a header saying how it was signed, a payload of claims, and a signature over the first two. The payload is not encrypted — it is merely encoded — so anyone holding the token can read every claim in it. That surprises people, and it is the single most important thing to understand about the format.

This tool decodes the header and payload and lays the claims out as a table, with the registered ones labelled: issuer, subject, audience, issued-at, not-before and expiry. The time claims are seconds since the epoch rather than milliseconds, which is a classic off-by-a-thousand error, and they are shown here both as a readable time and as a relative one, so an expired token is obvious at a glance.

It decodes; it does not verify. Verifying a signature requires the secret or the public key that signed it, and pasting a signing secret into a website would be a serious mistake regardless of who ran the site. Any tool offering to verify your token online is asking for exactly the thing you must never hand over. The signature is shown as it appears, and plainly described as unchecked.

The whole thing runs in this page, so the token never reaches a server. That still leaves the ordinary caution: a token in your clipboard or browser history is a live credential until it expires, so treat one you have pasted anywhere as worth rotating.