Paste the token
Drop in the compact serialization — header, payload and expiry decode instantly with human dates and a plain-English lifetime.
Free tools · Data
Read the token, don't trust it.
Headers, payloads and expiry status with explicit never-verified signatures — decoded on your device, never uploaded.
Decode · inspect · never verify here
Read the token, don't trust it.
Header, payload and time claims with expiry status, decoded as you paste. Signatures are reported, never verified — your tokens never leave this page.
Decode-only: this page has no keys and cannot verify signatures. Verify where you trust the key.
Header, payload and expiry status appear here.
How it works
Three steps, all on your device.
The same split-and-decode loop behind every API debugger, running here without accounts or uploads.
Read the status
Algorithm, signature presence and expired/not-yet-valid verdicts at a glance. Unsigned tokens and JWEs are called out, not silently mangled.
Copy the payload
Take the pretty-printed claims into tickets and debugging sessions — then verify the signature where you trust the key.
Questions
Decoding JWTs, answered.
If you manage servers by hand, see the engineering services behind this tools series.
Is my data uploaded anywhere?
No. Decoding runs entirely in your browser — the page makes no network requests with your tokens. You can verify this in your browser's developer tools or disconnect from the network after the page loads.
Does it verify the signature?
No, deliberately. Verification needs the signer's key and belongs where you trust it — your API, gateway or identity provider. This page reports whether a signature is present and which algorithm it claims, so you can inspect before you trust.
What does “expired 2h ago” actually compare?
The exp claim against your device clock at decode time. Skewed device clocks give skewed verdicts — and an unexpired token is still untrusted until its signature verifies.
Why reject encrypted tokens (JWE)?
A five-segment JWE is ciphertext, not claims — nothing here can read it without the decryption key. The page says so explicitly instead of showing garbage.
Is it safe to paste a production token here?
Safer than most decoders: nothing leaves your browser, nothing is stored, and there is no share-link feature to leak it. Still, treat any live credential as sensitive — prefer short-lived test tokens when debugging.