JWT Decoder
Paste a JSON Web Token to decode its header and payload, inspect claims, and see whether the exp claim has passed.
Runs locally in your browser. Your data never leaves your device.
JWT token
Decoded locally. This tool does not verify the signature.
Results
- Expires
- 1/1/2050, 12:00:00 AM
- Status
- Not expired
How to decode a JWT
Paste a JSON Web Token to inspect its header and payload claims without sending the token away from your browser.
What this decoder shows
The tool decodes the Base64URL header and payload, formats the JSON, and checks whether a numeric exp claim is already expired.
Important limitation
Decoding is not verification. Anyone can decode a JWT; signature verification requires the correct secret or public key and is intentionally not performed here.
Claims to inspect
- exp tells you when the token expires.
- iss often identifies the issuer.
- sub usually identifies the subject or user.
Local decoding
The token is decoded in your browser and is not sent to ProntoUso.
JWT decoder FAQ
- Does this verify the JWT signature?
- No. It only decodes header and payload so you can inspect claims safely.
- Is it safe to paste a token here?
- The tool runs locally, but you should still avoid pasting highly sensitive production tokens into any page you do not control.
- What if my JWT has no exp claim?
- The decoder still shows the payload, but it cannot tell whether the token is expired.