JWT Decoder
Decode a JSON Web Token and inspect its claims, expiry and algorithm. It runs in your browser, so the token never leaves your machine.
Inspect a JSON Web Token's header, payload and expiry. Decoding happens in your browser. The token is never transmitted.
Never paste a production token you still rely on into any online tool, including this one. Treat a token you've pasted anywhere as compromised and rotate it.
It runs entirely in your browser and nothing you type is transmitted or stored. The output is indicative and derived from your own inputs, so it is only as good as they are. It is educational material, not professional, financial, legal or tax advice, and it is not an audit, a quote or a substitute for review by someone who can see your actual environment.
- Cyber Security Knowledge Hub