Runs in your browser
JWT decoder
Paste a token to read its header, claims and expiry. It decodes only — signatures are not verified, and the reason matters.
Nothing you type here is uploaded, logged or seen by us. It works offline once this page has loaded.
Claims
Header
Payload
Not verified. Checking a signature needs the issuer's secret or public key, and a page that asked you to paste a signing secret would be the last page you should trust with it. Decoding tells you what a tokenclaims; only your server can tell you whether it is true.