Decode JWT header, payload, and claims — entirely in your browser.
Decoding happens entirely in your browser — nothing is sent to a server.
Paste a JSON Web Token to see its decoded header and payload, with temporal claims (iat, exp, nbf) converted to readable dates and a clear valid/expired indicator.
Decoding happens entirely in your browser using the Web Crypto-safe base64url decoder built into JavaScript — the token, including its signature, is never transmitted anywhere.
No — it only decodes the header and payload, which doesn't require the signing secret. Signature verification requires the key and is intentionally not done here to avoid ever handling secrets.