jwt-decoder
Paste a JWT to decode its header and payload and check the standard time claims. This decodes only — it does not verify the signature, and the token never leaves your browser.
client-side only
no signature verification
nothing sent anywhere
token.jwt
// what this does and doesn't do
// reading the time claims
- exp (expiration) and nbf (not before) are Unix timestamps in seconds, not milliseconds — a common off-by-1000x bug when these get compared against
DateTimeOffset.UtcNow.ToUnixTimeMilliseconds()instead ofToUnixTimeSeconds()in .NET. - Clock skew between your server and the token issuer is a frequent source of "valid token rejected" bugs —
Microsoft.IdentityModel.Tokens'TokenValidationParameters.ClockSkewdefaults to 5 minutes of leeway for exactly this reason.
A JWT's header and payload are just base64url-encoded JSON — no secret is needed to read them, which is exactly why you should never put sensitive data in a JWT payload assuming it's private. This tool decodes those two segments locally. It does not, and cannot, verify the signature, because that needs the signing key. A token can decode perfectly here and still be invalid, expired at the API level in a way this tool doesn't know about, or signed with a key that doesn't match your server.