Loading...
Paste a JSON Web Token and instantly see its decoded header and payload as formatted JSON, with signature visibility and the expiration claim (exp) checked against the current time so you know whether the token is still valid.
Essential for debugging OAuth flows, API 401s, and SSO sessions: see which algorithm a token signs with, which claims it carries, and how long it has left — all decoded locally in your browser. Tokens often carry user identifiers and scopes; here they never leave your device.
It decodes and inspects; signature verification requires the secret or public key, which only your auth server should hold. Use it to read claims and check expiry — trust decisions still belong to your backend.
Decoding is pure client-side base64 parsing — the token never leaves your browser. That said, treat tokens like short-lived passwords: prefer decoding test tokens, and rotate anything sensitive you have pasted into untrusted tools.
sub (subject/user id), exp (expires at), iat (issued at), iss (issuer), aud (audience), and scope/roles for permissions. Most "401 Unauthorized" debugging ends at an expired exp.
JWTs are signed, not encrypted — anyone can read the claims; what they cannot do is change them without invalidating the signature. Never put secrets in a JWT payload.
PureKit · jwt · Free online tool — files processed locally in your browser, no upload.