Is my token safe to paste here?

It is split and base64url-decoded by JavaScript in this tab, with no request sent and nothing written to storage. That is the actual reason to prefer a local decoder: pasting a live token into a remote one hands that server a working credential, not a string. It is still a credential on this machine, if it belongs to production and the machine is not yours, rotate it when you are done.

Why does my token show as expired when the API still accepts it?

exp, iat and nbf are counted in seconds since the Unix epoch and are always evaluated in UTC, while this table renders them in your local timezone. If your device clock is off, or the API allows a leeway window of a minute or two for clock skew, a token can look expired here and still pass server-side. Compare the raw exp number, not the formatted date.

What if the token has no exp claim?

The badge says so. A token without exp never expires on its own and can only be stopped server-side.

JWT Decoder

No upload · runs in your browser

Token

Tokens are split and decoded in this tab, nothing is uploaded, stored or logged.

How it works

JWT Decoder: Read the Claims, Check the Expiry

Paste a JSON Web Token to read its header and payload, see every standard claim as a real date, and check whether it has expired. The token is decoded on your device, the signature is not verified.

What this does

Base64url-decodes the header and the payload and pretty-prints both
Registered claims (iss, sub, aud, exp, nbf, iat, jti) in a table with what each one means
exp, nbf and iat as local dates with a relative time that keeps ticking while the tab is open
Wrong-shape tokens are named rather than guessed at: five segments is a JWE, a stray + or = is standard Base64

FAQ

No, it decodes, it does not verify. The third segment is a signature over the first two, and checking it needs the issuer’s shared secret for HS256, or the public key for RS256 and ES256. A web page has no safe way to hold either, and asking you to paste an HMAC secret into a form would be worse than useless. So treat a decode as informational only: anyone can edit a payload and re-encode it, which means a readable claim proves nothing about who issued the token or whether it was altered. Read the claims here, make the authorisation decision from a server-side verify.

Keep going