JWT Decoder

A JSON Web Token is just three Base64URL-encoded segments joined by dots: a header, a payload, and a signature. The header and payload are plain JSON underneath the encoding — no cryptographic key is needed to read them, only to verify that the signature over them is valid.

When you paste a token in, everything happens with JavaScript already loaded in the page. The token is split on its two dots, the header and payload segments are decoded from Base64URL back into JSON text, and that text is parsed and rendered as a table of claims. Standard claims get special handling: exp (expiration time), iat (issued at) and nbf (not before) are Unix timestamps in seconds, so each one is converted to a readable date, and the exp claim is compared against the current time to show a clear expired or valid flag at a glance.

This is decoding, not verification. Verifying a JWT means checking its signature against the secret or public key that issued it, which proves the token wasn't tampered with — and since we never see that key and never want to, we don't attempt it. A token can be perfectly well-formed and fully decodable while still being invalid, forged, or expired at the issuing server; treat the decoded output as a way to inspect a token's contents, not as proof it should be trusted.

Nothing about the token is transmitted anywhere. The decoding, parsing and expiry check all happen locally in your browser, and the token never leaves your device.