Inspect a token's header, payload and claims.
Paste a token and it is decoded as you type. Nothing is uploaded and nothing is stored.
Three dot-separated parts: header, payload and signature.
This tool only base64-decodes the token. It does not check the signature, so the contents could have been written by anyone. Never trust an unverified token for authentication or authorization: verify it on your server against the issuer's key first.
From the maker of MakeUUID
Three base64url parts joined by dots.
A JWT is a header, a payload and a signature, each base64url-encoded and joined with dots. The header names the signing algorithm, the payload carries the claims, and the signature ties the two together. Only the signature is secret-dependent: the header and payload are encoded, not encrypted, so anyone holding the token can read them.
That is worth repeating. Base64url is not a cipher. Do not put passwords, API keys or anything else private in a JWT payload, because every party that handles the token can read it as easily as this page does.
Claims like exp, nbf and iat are seconds since the Unix epoch, not milliseconds. A token that looks expired by fifty years is usually a millisecond value in a seconds field.
Decoding happens in your browser, so this page never sends the token anywhere. It can still end up in your clipboard history or in a screenshot, and a live access token is a live credential until it expires. Prefer a token from a test account when you can.