JWT decoder
Decode a JSON Web Token to see its header, claims and expiry, entirely in your browser.
How it works
A JWT is three Base64URL parts: header, payload and signature. Decoding reads the first two; checking the signature needs the key.
Questions
Is it safe to paste a token here?
Decoding happens in your browser and nothing is sent. Still, treat live tokens like passwords.
Is a decoded token valid?
Not necessarily. Only verifying the signature with the right key proves it.