Decode a JWT online to read its header and payload and check expiry. Free, instant and private — decoding runs entirely in your browser.
Paste a JSON Web Token into the box and its three parts are decoded immediately: the header (which algorithm and token type), the payload (the claims — who the token is for, what it grants, and when it expires) and the signature portion. Expiry and issued-at timestamps are shown in a readable form so you can tell at a glance whether a token is still valid.
Nothing is submitted anywhere — the moment you paste, the decode happens in your browser.
When an authenticated request fails, the token is usually the first suspect: is it expired, is it for the wrong audience, does it carry the roles you expect? Reading the claims answers those questions in seconds and saves a lot of guessing during auth debugging.
Because tokens often belong to real users or services, decoding them on a server you don't control is a risk. A client-side decoder keeps the token on your machine.
A JWT is three Base64URL-encoded sections joined by dots. The decoder splits on the dots and Base64URL-decodes the header and payload back into JSON, then formats the timestamps. It does not verify the signature — verifying would require the signing secret or public key, which you should never paste into a web page — so treat the decoded contents as informational, not proof of authenticity.
The entire process runs locally; your token is never uploaded or logged.
No. It reads the header and payload only. Verifying the signature needs the secret or public key and should be done server-side.
The decode runs entirely in your browser and the token is never uploaded, but treat any token as a live credential regardless.
The decoder converts the exp claim to a readable date so you can compare it to the current time.
It is the set of claims the token carries — such as subject, audience, roles and expiry — encoded as JSON.