JWT decoder
Read a token's header and claims. Nothing leaves the page.
What this does
A JSON Web Token (JWT) is three base64url parts joined by dots: a header, a payload of claims, and a signature. This reads the header and payload and shows them as formatted JSON. Nothing you paste here is sent anywhere — it is decoded in your browser.
The signature is not checked
Decoding a JWT never proves it is genuine. Checking the signature needs the secret or public key that signed it, which this page does not have and never asks for. Treat a token you cannot verify as untrusted, even if the payload looks right.
exp, iat and nbf
iat is when the token was issued, nbf is the earliest it is valid, and exp is when it stops being valid — all as seconds since 1970. This page turns them into UTC dates and tells you plainly if the token has expired.