JWT Decoder

A JWT (JSON Web Token) is a compact, URL-safe way to represent claims between two parties — commonly used for login sessions and API authentication. It's made of three Base64URL-encoded parts separated by dots: a header describing the signing algorithm, a payload holding the actual claims (like user ID, roles, or expiry time), and a signature that proves the token hasn't been tampered with, if you have the secret key.

This tool decodes the header and payload so you can read their contents, and flags whether the token has an exp (expiry) claim and whether it's expired. It does not and cannot verify the signature — that requires the secret or private key the token was signed with, which this tool never asks for. Decoding a JWT reveals its contents to anyone who has the token; treat tokens as sensitive, since the payload is readable by design even though it can't be modified without invalidating the signature.

Version 1.0.0