Is it safe to paste my JWT here?

Yes — this tool runs entirely in your browser. Your token is never sent to any server. That said, avoid pasting production tokens from sensitive systems into any online tool as a general security habit.

Can this tool verify the JWT signature?

No. Signature verification requires the secret key (for HS256) or the public key (for RS256/ES256), which you should never share. This tool decodes the header and payload, which are only Base64-encoded — not encrypted — and readable without the key.

What is a JWT used for?

JWTs are commonly used for authentication and authorization. After logging in, a server issues a signed JWT containing claims (like user ID and roles). The client sends this token with each request, and the server verifies the signature to trust the claims without a database lookup.

Why does my JWT say it is expired?

The exp claim is a Unix timestamp. If the current time is past that value, the token is expired. You need to re-authenticate to get a fresh token. This tool shows the human-readable expiry date so you can easily check.

🔑

JWT Decoder

Decode and inspect JWT tokens instantly. View header, payload, expiry, and signature. Check token validity. Free, runs locally.

About this tool

Decode and inspect JSON Web Tokens (JWTs) without sending anything to a server. Paste any JWT to instantly view the decoded header and payload as formatted JSON, check the expiry time, and validate the token structure.