keySecurity
JWT Decoder
Paste a JWT to see its decoded header and payload, with the standard time claims rendered as readable dates and an expiry check. Decoding only — the token is never sent anywhere and the signature is not verified, which is deliberate.
JWTClaimsAuth
key JSON Web Token
lock
Decoding is not verification. A JWT payload is only Base64 — anyone holding the token can read it, so never put secrets in one. This tool deliberately does not check the signature: that requires the issuer's key and must happen on your server. Treat any token you paste here as compromised if it came from somewhere you do not control.
What this tool does
- check_smallDecodes the header and payload from base64url
- check_smallHuman-readable iat, nbf and exp with relative time and an expiry warning
- check_smallExplanations of the registered claims (iss, sub, aud, jti and friends)
- check_smallColour-coded segments so you can see where the token splits
- check_smallRuns locally — nothing is transmitted, and no signature is verified
Privacy
This tool runs entirely in your browser using client-side JavaScript. Whatever you paste stays on your machine — there is no back end, no upload and no analytics on your input.