Developer · free local utility
Inspect a token's readable claims and time window without sending the token to a server or confusing decoding with signature verification.
Paste a three-part JWT. The page decodes header and payload only, never asks for a secret, and compares time claims with this device clock.
Synthetic alg=none token with sub=demo-user and an expiry in 2100
Decoded, not verified · active now · header and payload shown as formatted JSON
Decoded does not mean authentic. This tool does not verify a signature, trust the issuer, fetch keys, or prove that a token is safe to accept.
Always verify the result in the system where you will use it. The page intentionally avoids accounts, uploads, and claims that go beyond the calculation it performs.
No. It intentionally decodes only. Signature verification requires a trusted key, allowed algorithm, issuer, audience, and application policy.
JWT header and payload segments are Base64URL-encoded, not encrypted. Never put a secret in a normal signed JWT payload.
NumericDate values are Unix seconds. The status is compared with this device clock, which may be incorrect or skewed.
Browse every developer tools in this workflow.