Decode a JWT

Paste a token to read its header and payload, with iat, nbf and exp rendered as real dates. This decodes; it does not verify. Verifying a signature needs the signing key, which belongs on your server and should never be pasted into a web page — so nothing here tells you a token is genuine, and anything a token claims about its own expiry is just that: a claim, which anyone can forge. The token is processed on your device and never sent anywhere, which matters because a JWT is a credential.

This is processed on your device and never sent anywhere. Nothing you paste here leaves this tab, and nothing is saved after you close it.

Token0 characters

or paste above

This decodes the token. It does NOT verify the signature — that needs the signing key, which stays on your server. Anything below is what the token says about itself, not proof that it is genuine.

This tool runs entirely in your browser, so the controls above need JavaScript to do anything. The description stays readable either way — nothing here was ever going to be processed on a server.