Decode a JWT header and payload, check its expiry, and see whether a signature is present — without ever sending your token anywhere.
This decoder never verifies signatures and never sends your token anywhere. A token can be decoded but still be forged — only the issuing server can verify it.
How to use this tool
The full token: header.payload.signature, three dot-separated parts.
Both JSON parts are pretty-printed.
Algorithm, signature presence and expiry are summarised, with warnings.
The sample token shows the layout without using a real credential.
Formula & worked example
The sample token decodes to header {"alg":"HS256","typ":"JWT"} and payload {"sub":"1234567890","name":"John Doe","iat":1516239022}, with no exp claim, so no expiry verdict is possible.
Limitations — read this before you rely on it
This decodes but does NOT verify signatures — verification needs the secret (for HS256) or public key (for RS256), which you must never paste into a web page. A decodable token can still be forged. Tokens are also only base64url-encoded, not encrypted: anyone holding one can read its payload.
Frequently asked questions
A JSON Web Token: a compact, URL-safe way to carry claims (like a user id and expiry) between a server and a client, usually as an Authorization: Bearer token.
No. Decoding only reads it. Verification checks the signature against the issuer's key — only the issuing server (or a holder of its public key) can do that.
Its exp claim is in the past. Tokens are meant to be short-lived; the client should refresh or re-authenticate.
The token claims no signature. Such tokens should never be trusted — they are trivially forgeable.
This page runs entirely in your browser and never sends the token anywhere, but as a habit, prefer decoding tokens in your own tools rather than pasting production credentials into any website.