JWT decoder
Decode a JSON Web Token, read its claims in plain language, check its times, and verify its signature with a key you paste.
Everything happens in this browser. What you paste is not sent or stored, and leaving the page clears it.
What the decoder checks
Decoding only reads the token. Anyone can decode a JWT, because its header and payload are base64url-encoded, not encrypted. What makes a token trustworthy is the signature, checked with the issuer's key, and the claims: who issued it, who it is for, and when it is valid. The decoder reports times in UTC and allows one minute of clock difference.
A verifier should never let the token choose its own key, so the decoder warns about jku, jwk and x5u headers and uses only the key you paste.