Security
Decode and inspect JSON Web Tokens without sending data to a server.
100% client-side · Data never leaves your device · Free forever
Signature (unverified)
—
A JSON Web Token has three Base64URL parts: header, payload, and signature. This debugger pretty-prints claims like sub, iat, and exp locally.
Decoding only reads the contents. Verification proves the token was signed by a trusted key. Never trust authorization decisions from decode-only inspection.
No. It only Base64URL-decodes the header and payload. Signature verification requires the secret or public key and is intentionally out of scope for this client-only tool.
Tokens can grant access. This page does not upload them, but you should still avoid sharing screenshots or copying tokens into untrusted machines.
exp is the expiration time as a Unix timestamp (seconds). The decoder shows ISO time and whether the token appears expired on your clock.