JWT Decoder runs locally, nothing is uploaded

A JWT is three base64url parts joined by dots: header.payload.signature. Paste one (a leading Bearer is fine) to see what is inside.

Decoding is not verifying. Anyone can read and forge the header and payload; only a valid signature proves the token came from the issuer. Never trust claims you have not verified on the server.

exp (expires), nbf (not before) and iat (issued at) are seconds since 1970-01-01 UTC; they are shown as dates with the time left or passed.

To check a signature, enter the shared secret for HS256/384/512, or paste the public key (PEM -----BEGIN PUBLIC KEY----- or a JWK) for RS*, PS*, ES* and EdDSA. Keys and secrets stay in this tab and are never saved.

Shortcut: Ctrl/⌘+Enter copies the payload JSON. Link straight to a token with #token=<jwt> — the part after # is not sent to any server, but treat such links as secrets.