Decode a JWT into header and payload JSON

Paste a token. See claims, exp/iat, and raw JSON. The signature never leaves the tab.

This is debugging, not a replacement for server-side verification.

A compact JWT is three Base64url parts split by dots: header, payload, signature. Paste only the token, not the Bearer prefix. exp: 1700000000 means the token is expired if that second is in the past; the page shows the date and does not call the issuer. alg: none and an empty signature are a known footgun: a debugger may still print the claims. Verification needs the secret or public key on a server. This page is the decode view. The glossary page explains what a claim is.