Paste any JWT token to decode and inspect the header, payload, and expiry status. No signing key required — decode only, nothing is sent to any server.
A JSON Web Token (JWT) has three Base64url-encoded parts separated by dots: Header (algorithm and token type), Payload (claims about the user), and Signature (cryptographic proof of integrity). You can read the header and payload without the signing key — only signature verification requires it.
sub — Subject (user ID). exp — Expiry as Unix timestamp (seconds since 1970). iat — Issued-at time. iss — Issuer (your auth server). aud — Audience (who the token is for). Custom claims beyond these are application-specific.
This tool runs entirely client-side — your token is never transmitted. However, treat production JWTs with real user data as sensitive credentials. Avoid pasting live tokens into untrusted tools. For debugging, use short-lived test tokens or revoke production tokens after use.