Paste a JSON Web Token below to see its decoded header and payload, plus whether it's expired. Runs entirely in your browser — the token never leaves your device.
A JSON Web Token has three Base64URL-encoded parts separated by dots: header.payload.signature.
This tool decodes the header and payload so you can read the claims (like exp, iat,
sub) — but it does not and cannot verify the signature, since that requires the
secret or public key the token was signed with. Never paste a real production token with sensitive claims
into a tool you don't fully trust; this one is client-side only, but always double-check.