Security tool
JWT Decoder
Decode a JSON Web Token to read its header and payload, and see human-readable expiry, issued-at and not-before times. Decoding is not verification — the signature is not checked, and nothing leaves your browser.
Standard claims
Decoding is not verification. A JWT’s payload is Base64-encoded, not encrypted — anyone can read it. Only the signature proves the token was issued by who it claims, and checking that requires the signing key on the server. Never treat a decoded token as trusted input.