Token inspection tool
JWT Decoder
Inspect a JSON Web Token’s header, payload, claims, and timing information. Your token stays in this browser.
JWTs are inspected locally and are never sent to a server.
About this tool
Understand what a JWT contains
A JSON Web Token usually contains three Base64URL-encoded sections: a header, a payload, and a signature. The first two sections are readable metadata, not encrypted secrets.
This decoder formats both JSON objects, surfaces common registered claims, and interprets issued-at, not-before, and expiration timestamps. It deliberately does not claim to verify authenticity without a signing key.
How it works
Inspect a JWT in three steps
- 1Paste the token
Add a complete JWT with header, payload, and signature sections.
- 2Decode locally
The browser reads the Base64URL sections and parses their JSON.
- 3Review carefully
Inspect claims and timing, remembering that decoding is not signature verification.
Common questions
JWT Decoder FAQ
Does this tool verify a JWT signature?
No. It decodes the readable header and payload but does not prove that the signature is authentic. Signature verification requires the correct secret or public key and expected algorithm.
Can I safely paste a JWT here?
Decoding happens locally in your browser and the token is not sent to UtilityBase. Even so, handle production tokens carefully because they may grant access if copied elsewhere.
How is expiration determined?
When the payload contains a numeric exp claim, the tool compares that Unix timestamp with the current time on your device. It also recognizes a future nbf claim.
Can an expired JWT still decode?
Yes. Expiration affects whether an application should accept a token, but the Base64URL-encoded header and payload remain readable.