Paste a JSON Web Token to read its header and claims, see when it expires, and check the signature — all in your browser.
The three parts are coloured so you can see header, payload and signature.
Times are shown in your time zone, with expiry flagged.
Add the secret or public key to check the signature — still only in your browser.
Decoding happens in your browser and nothing is sent anywhere. Still, a token is a password: don’t share live tokens, and prefer expired or test ones.
Yes. The header and payload are only Base64-encoded, not encrypted. Never put secrets in a JWT payload.
The token isn’t signed at all. Servers should reject it — we flag it in red.