JWT Decoder
Read the header and claims of a JSON Web Token, with timestamps resolved to real dates and expiry checked against now.
Three Base64url segments separated by dots. The token stays in this tab.
This does not verify the signature
Decoding and verifying are different jobs. The payload of a JWT is only Base64url, not encryption, so anyone holding the token can read every claim in it. This tool shows you those claims. It does not check the signature, because doing that needs the issuer's key and would mean sending either the token or the key somewhere.
The practical consequence: never trust a claim you decoded here as proof of anything. Treat a token you paste in as still valid and still sensitive, and do not paste a production token belonging to someone else.