Paste a JSON Web Token to decode its header and payload into readable JSON and see right away whether the exp claim has expired.
The JWT decoder splits a JSON Web Token into its parts and shows the header and payload as formatted JSON. The header tells you the signing algorithm and token type, and the payload lists the claims, such as subject, issued-at time, roles or any custom fields your service adds.
If the token has an exp claim, the tool compares it with the current time and shows either how many minutes remain or the date and time it expired. A sample token is available if you want to see how it works. Decoding happens in your browser, which helps when you are debugging login sessions or API authorization. Note that the tool reads the token but does not verify its signature, so a decoded token is not proof that it is genuine.
No. It decodes the header and payload and checks the exp claim, but it does not verify the signature with a secret or public key.
The token is decoded in your browser and not sent anywhere. Still, treat live tokens as secrets and avoid sharing them.