Paste a JSON Web Token to read its header and payload, with timestamps rendered as dates and the expiry checked against the current time. Decoding happens locally, so tokens stay on your machine.
Header, payload and signature split out clearly
Expiry and issued-at shown as human-readable dates
Nothing is transmitted — safe for real access tokens
Frequently asked questions
Does decoding a JWT verify its signature?
No. Decoding only reads the token contents. Verifying the signature needs the issuer's secret or public key, which should only ever happen on your server.
Is it safe to paste a live token here?
Yes. The token is parsed in your browser and never sent over the network.