JWT Decoder & Inspector
Decode, inspect, and validate JSON Web Tokens (JWT) client-side. Parse header, payload claims, and expiration timestamps.
Related Tools
Frequently Asked Questions
Is it safe to paste sensitive JWTs or authentication tokens here? ↓
Yes, 100%. This tool operates entirely inside your web browser using JavaScript. No network requests are made, and your tokens or secrets are never transmitted to any server.
Does this tool verify the signature of my token? ↓
JWT signatures can be verified client-side using standard Web Crypto APIs for HMAC-SHA256 (HS256) by providing your secret key locally. The secret key never leaves your device.
How are expiration (exp) and issued-at (iat) dates calculated? ↓
Standard JWT timestamps represent Unix epoch seconds. We automatically parse them into your local timezone, ISO 8601 timestamps, and human-readable relative durations (e.g., "Expired 12 minutes ago").
What parts make up a JSON Web Token? ↓
A standard JWT consists of three Base64URL-encoded parts separated by dots (.): the Header (specifies algorithm & token type), the Payload (user claims and metadata), and the Signature.