JWT Decoder
Decode a JWT header and payload and check its expiry.
🔒 Runs entirely in your browser — your token is never uploaded.
⚠️ This only decodes the token - it does not verify the signature.
How JWT Decoder works
How does the JWT decoder work?
It splits the token on . into header, payload, and signature, then base64url-decodes the first two segments by swapping -/_ back to +// and padding with = before running them through atob() and JSON.parse(). If the payload has an exp claim, it converts that Unix timestamp to a date and flags whether the token has already expired.
What is this used for?
It is useful for inspecting the claims inside an access or ID token while debugging an authentication flow, without pasting a token into a third-party site.
Does it verify the token is genuine?
No, and the page says so directly - it only decodes the header and payload, it never checks the signature. Verifying a signature requires the issuer's secret or public key, so anyone can hand-craft a token with a fabricated payload; do not treat a decoded claim as proven authentic.