JWT decoder

Paste a JSON Web Token to read its header and payload. Time claims (exp, iat, nbf) are shown as dates, and the status line says when it expires.

Input · JWT

Open file

Output · JSON

Waiting for input

Runs in this tab. The text is not sent anywhere.

Questions

Is the signature checked?

No. Checking needs the signing key, and a web page is the wrong place to paste one. The tool only reads what the token says.

Is it safe to paste a real token?

The token is decoded in this tab and not sent anywhere. A token is still a credential: do not paste live ones into tools you do not trust.