Decode a JSON Web Token's header and payload to inspect its claims and expiry. Your token is parsed locally — it never leaves your browser, so it stays safe to paste real tokens.
No. It only Base64URL-decodes the header and payload and displays their contents. A token with a forged or stripped signature decodes just as cleanly, so never treat a successful decode as proof that a token is authentic.
Yes. Parsing happens locally in your browser and the token is never uploaded, so secrets stay on your device. You should still avoid sharing tokens in screenshots or chat, since anyone who has the token can replay it.
If the payload contains a numeric exp claim, it is compared with the current time from your device clock in UTC. An inaccurate clock gives an inaccurate result, and a token with no exp claim is decoded without any expiry check.