Read JWT headers, payloads and time claims
A JSON Web Token is three Base64URL segments: the header (algorithm and type), the payload (claims such as user ID, roles, and expiry), and the signature. This tool splits the three parts, pretty-prints header and payload as JSON, and converts Unix-timestamp claims like exp, iat, and nbf into readable dates so you can see at a glance when the token was issued and when it expires.
Decoding happens entirely in your browser. Still, prefer test-environment tokens — this site never uploads anything, but pasting production tokens into any web page is a habit worth avoiding.
Inspect JWT claims during authentication debugging
When an API suddenly returns 401, decode the token and check exp first. When integrating a third-party platform, confirm which claims it actually issued. When debugging permissions, verify the role and scope fields. All much faster than printing tokens into logs and squinting.
JWT decoding does not verify signatures
The most important point: decoding is not verification. Anyone can read and modify the Base64URL sections of a JWT; this tool only reads it and does not check the signature. A server must verify the signature with its secret before trusting any claim. Never make security decisions client-side from a decoded payload, and treat alg=none, weak algorithms, or an expired exp as invalid tokens.
Does a readable JWT with a future expiry prove it is valid?
No. Anyone can construct readable header and payload data. This tool does not verify the signature, issuer, audience or authorization policy. The time display is for inspection; the service accepting the token must verify it independently.