Paste a JWT to decode it. Your token never leaves your browser.

1000).toLocaleString()]); if(payload.nbf)claims.push([‘nbf (Not Before)‘,new Date(payload.nbf*1000).toLocaleString()]); if(claims.length){ html+=’'; } // Signature html+=’’; el.innerHTML=html; } function timeAgo(date){ const s=Math.abs(Math.floor((new Date()-date)/1000)); if(s<60)return s+‘s ago’;if(s<3600)return Math.floor(s/60)+‘m ago’; if(s<86400)return Math.floor(s/3600)+‘h ago’;return Math.floor(s/86400)+‘d ago’; } document.getElementById(‘jwt-input’).addEventListener(‘input’,decodeJWT); decodeJWT();

What is a JWT?

A JSON Web Token has three parts separated by dots:

header.payload.signature

• Header — algorithm and token type
• Payload — claims (user data, expiration, etc.)
• Signature — verifies the token hasn’t been tampered with

Security Note

This tool runs entirely in your browser. Your JWT is never sent to any server. However, never paste production tokens with sensitive data into any online tool you don’t trust.

Related: AI Security Checklist