Why not verify signatures?

Verifying requires the signing key. Doing that in a browser is either wrong (leaking the key) or theatrical. Verify server-side.

Are tokens sent anywhere?

No. Decoding happens entirely in your browser.

JWT Decoder

Inspect JWT header and payload with expiry checks. Signature is not verified.

Share on X LinkedIn Hacker News

Paste a JWT

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Time claims OK

JWTs are only decoded — signature is not verified. Never trust decoded claims without server-side signature verification.

Runs entirely in your browser — nothing you paste is sent to a server.

About this tool

A no-network JWT inspector. Paste a token, see the header and payload as pretty JSON, and get a warning if exp or nbf claims are outside the current time. Signature verification is intentionally omitted — that must happen server-side with your secret.

How it works

Split the token on '.' into header, payload, signature.
Base64url-decode header and payload; parse as JSON.
Compare exp / nbf against the current UNIX time and surface warnings.

When to use it

Debugging an auth issue in local dev without exposing tokens to a public site.
Inspecting third-party OAuth tokens during integration work.
Teaching workshops on how JWTs are structured.

FAQs

Related resources

Related workflows

Claude Research Brief: From Question to Cited Draft Cursor: Plan-File API Refactor Playbook Make.com: Invoice Extraction with GPT-4o Vision Zapier: AI Lead Enrichment to CRM MCP Filesystem Server for Local Coding Agents