Decode & Inspect a JWT Online

A JWT has three dot-separated parts: a header (algorithm and type), a payload of claims such as user, role and expiry, and a signature. This tool Base64URL-decodes the first two and prints the JSON in order, and when an expiry claim (exp) is present it also works out the days remaining. The signature is not verified, because proper verification needs the server’s key - so use this to read and debug a token, not to prove it is genuine.

This tool runs entirely in your browser. No data is sent to any server.

How to use it

1. 1

   Paste the token, or load an example with the sample button.

2. 2

   The header and payload appear as formatted JSON.

3. 3

   If there is an expiry claim, check whether the token is still valid and refresh it when needed.

Frequently asked questions

Is the signature verified?

No. Verifying it needs the signing secret or public key, which only lives on the server; this tool just opens the content.

Is my token sent to a server?

No, decoding happens in the browser. Still, avoid pasting production tokens into chats or unknown tools - a JWT is as sensitive as a password.

Why is the expiry shown in days?

The exp claim is a Unix timestamp (seconds since 1970); the tool compares it with the current time and shows the difference in days.