jwt-decoder
Paste a JWT to decode its header and payload, check the standard time claims, and verify its signature against a secret or public key — entirely in your browser, the token never leaves it.
// what this does and doesn't do
// reading the time claims
exp (expiration) and nbf (not before) are Unix timestamps in seconds, not milliseconds — a common off-by-1000x bug when these get compared against DateTimeOffset.UtcNow.ToUnixTimeMilliseconds() instead of ToUnixTimeSeconds() in .NET.
Clock skew between your server and the token issuer is a frequent source of "valid token rejected" bugs — Microsoft.IdentityModel.Tokens' TokenValidationParameters.ClockSkew defaults to 5 minutes of leeway for exactly this reason.
// learn more
For a fuller breakdown of a JWT's structure and how signature verification actually works, see What Is a JWT? If this token came from a login or refresh-token endpoint you're about to call again in code, the cURL Converter turns that same curl command into a working Authorization: Bearer request in C#, Python, JavaScript, Go, Java, or PowerShell.
A JWT's header and payload are just base64url-encoded JSON — no secret is needed to read them, which is exactly why you should never put sensitive data in a JWT payload assuming it's private. This tool decodes those two segments locally, and verifies the signature too if you provide the shared secret (HS256) or public key (RS256/ES256) — entirely in your browser, nothing sent anywhere. What it still can't tell you: whether the token's been revoked server-side, or whether you're checking it against the key your server is actually using right now if that key has since rotated.