JWT Decoder

JWT decoding is pure arithmetic: split the token on the dots, decode each Base64URL segment, and pretty-print the JSON. Nothing about that needs a server, so this tool performs the whole decode in your browser. The token you paste stays on your device — especially important because tokens often carry session and identity claims you would not want to upload anywhere.

A JWT has three dot-separated parts. The header describes the signing algorithm and token type. The payload carries the claims — registered ones like iss (issuer), sub (subject), aud (audience), exp (expiration), nbf (not before), iat (issued at) and jti (JWT ID), plus any custom claims an application adds. The third part is the signature; decoding does not reveal it or verify it.

The tool reads exp and nbf automatically and reports whether the token is currently valid, when it expires (or expired), or when it becomes valid. No calculator or mental timezone math needed — the times are shown in UTC.

Anyone can decode a JWT — the payload is just Base64URL data, not encrypted. Trusting a token requires verifying its signature with the issuer's secret or public key. This tool clearly marks the signature as present but never verified, and the validity hint is only about the token's own time claims, not about whether the signature is genuine.

Because processing happens in your browser, there is no upload endpoint in the flow, no log of your token, and no storage. The page needs no account and no tracking of the token content.