JWT decoder
Paste a token to read its header, its claims and its timestamps in local time. This decodes; it does not verify the signature, so what it shows you is what the token claims, not what is true. Nothing is uploaded; the decoding happens in this tab.
Token
Decoding is not verifying
Anyone can write any claims they like into a token. Until the signature is checked against the issuer’s key, everything above is only what the token says about itself — never treat it as an identity or a permission. A real token is also a live credential for as long as it is valid: paste one into a tool you have not read the source of and you have handed it over. This one decodes in your browser and sends nothing anywhere, which you can confirm in your network tab.