JWT decoder
Paste a JSON Web Token to see its header, claims and timestamps, with red flags called out.
Runs in your browser. Nothing is sent unless you choose Check reputation, and nothing is stored.
What it shows
The decoded header and payload as formatted JSON, with exp, iat and nbf turned into readable dates. It flags tokens that are expired, not valid yet, have no expiry, have no signature, or use alg "none".
It doesn't verify the signature: that needs the issuer's key, and pasting secret keys into websites is a bad habit.
Your token stays with you
Decoding happens in your browser. What you paste isn't sent to our server or anyone else, so it's safe to use with tokens and emails from real incidents.