JWT decoder
Reads the header and claims of a token so you can see what it asserts and when it dies. Decoding happens in this tab and the token is never put in the URL, because a JWT in a browser history or a referrer header is a credential you have handed away.
Everything you type stays in this tab. Share copies a link, never your inputs, unless the tool says it encodes them in the URL.
Header
–
Claims
–
This does not verify the signature, and nothing that decodes a token in a browser can. Verification needs the issuer's key and a library that checks the algorithm against what you expect. A token that decodes cleanly is not a token that is valid.