Paste any JSON Web Token to instantly decode the header, payload, claims, and expiry.
Yes — this tool runs 100% in your browser. Your token is never sent to any server. You can verify this by going offline before pasting. That said, avoid pasting production tokens with sensitive claims into any online tool as a general security practice.
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three Base64URL-encoded parts: Header (algorithm & type), Payload (claims), and Signature. JWTs are commonly used for authentication and API authorization.
No — verifying a signature requires the secret key or public key used to sign the token. This tool only decodes the publicly readable parts (header and payload). Signature verification must be done server-side where the secret is held.
The "exp" claim (Expiration Time) is a Unix timestamp representing when the token expires. This decoder shows it in human-readable form and tells you whether the token is currently valid or has expired.
Common algorithms include HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), and ES256 (ECDSA, asymmetric). The algorithm is shown in the "alg" field of the header.