Loading…
Paste a JWT and read its header and payload as JSON — every registered claim explained, timestamps in your local time, the expiry worked out against your clock. It all happens in this tab, which matters for tokens. And the signature is not verified: that takes the signing key, and belongs on a server, not a web page.
Paste a JWT — line breaks, surrounding quotes and a Bearer prefix are all fine. Nothing leaves this tab.
The signature is not verified — by design.
This tool shows what a token says, not whether it’s genuine. Anyone can mint a token with any claims in it; telling a real one from a forgery means checking the signature against the signing key, and that belongs on a server that holds the key — not on a web page.
Decoding runs entirely in this tab. That matters for tokens: a live JWT is a credential, so paste it into nothing that uploads it. This page doesn’t.
Paste into the editor or open a file — everything you add stays in this tab, and you see exactly what the tool will work on before anything runs.
Your browser does all the work locally. Nothing is uploaded — what you paste never leaves this tab, so there’s nothing for anyone to store, scan, or leak.
One press puts it on your clipboard, ready to paste where you need it. There is no file to download — the result is text, not a document. Close the tab and nothing of what you pasted remains.