Decode and inspect a JWT’s header, claims and expiry without sending it anywhere.
JWT Decoder splits a JSON Web Token into its header and payload, decodes the Base64URL segments and presents the claims in readable form — including human-friendly expiry and issued-at times.
It runs entirely in your browser, so even live session tokens are safe to inspect.
It decodes and inspects the token (no secret needed). For offline secret cracking and signature attacks, use the Vulnerability Scanner’s server-side JWT engine.