Token decoder
Paste a token and it works out what it is — a JWT signed or encrypted, a PASETO, a signed session cookie, one base64url segment out of a log — and reads back whatever of it can be read, with the timestamps in local time. When there is nothing to read, because the token is encrypted or just a random string, it says that rather than failing. This decodes; it never verifies a signature, so what it shows is what the token claims, not what is true. Nothing is uploaded; it all happens in this tab.
Decoding is not verifying
Anyone can write any claims they like into a token. Until the signature is checked against the issuer’s key, everything above is only what the token says about itself — never treat it as an identity or a permission. A real token is also a live credential for as long as it is valid: paste one into a tool you have not read the source of and you have handed it over. This one decodes in your browser and sends nothing anywhere, which you can confirm in your network tab.