JWT Decoder
Paste a JSON Web Token to inspect its header and payload — with issued-at and expiry timestamps translated into readable dates. Decoding is local; the token is never sent anywhere.
FAQ
Does this tool verify the signature?
No — it decodes and displays the token contents. Signature verification requires your secret or public key and should happen in your backend.
Is it safe to paste my token here?
The token is only decoded in your browser and never transmitted. Still, expired or shared tokens are best treated as sensitive.
What do the standard claims mean?
iss = issuer, sub = subject, iat = issued at, exp = expiry, aud = intended audience — the tool translates the timestamps for you.