Inspect tokens without a server
A JWT has three parts separated by dots: header, payload, and signature. This tool decodes the first two so you can read the claims (user ID, roles, expiry). It also checks the exp field and tells you if the token has expired.
Important: decoding ≠ verifying
JWTs are Base64-encoded, not encrypted — anyone can read the payload. This tool does not verify the signature (that needs the secret key). Never trust a token's contents without server-side verification, and never paste production tokens containing secrets into any website. This tool works entirely offline in your browser for safety.