Decode JWT header and payload locally so you can inspect claims and timestamps without sending the token anywhere.
Decoding is not signature verification. This tool reads token contents only.
Yes.
No. The token stays in the page.
No. Decoding only reads the token parts. Signature verification is a separate step.
Yes. Common timestamp claims are shown both as raw values and readable dates when possible.
Decoding lets you inspect claims like issuer, audience, subject, scope, and expiry without touching your backend.
What it does not tell you is whether the token is trusted. Reading a payload and verifying a signature are separate steps.
Even if the page stays local, production tokens still should not end up in screenshots, tickets, or chat threads.
If you need real verification, use a verifier instead of assuming the decoded payload can be trusted.
These pages are meant to stay direct: input at the top, results immediately below, then the FAQ and related guides if you need more context.