Local-onlydecode · never uploaded · signature not verified
JWT Decoder
Paste a JSON Web Token to inspect its header and payload claims. Processed locally in your browser. Signature verification is intentionally not performed — decoding is not verification.
What this does
- Decodes the header (algorithm, type) and payload (claims: exp, iat, iss, aud, sub, nbf, jti).
- Shows human-readable expiration and issued-at timestamps.
- Does not verify the signature — treat decoded claims as untrusted input.
- Never uploads the token; runs fully in your browser.
Related Knowledge
- Decode JWTs Safely — how to read header and payload without trusting them.
- Secrets Management — key and token hygiene.