JWT tools

JSON Web Tokens turn up everywhere in modern auth — in Authorization headers, cookies, and OAuth flows — and sooner or later you need to see inside one. The decoder splits a token into its header and payload, renders the claims as readable JSON, explains registered claims like iss, sub, aud, and exp, and converts timestamp claims into actual dates. The expiration checker answers the narrower, more urgent question: is this token expired, and if not, how long does it have left?

That makes these tools a quick way to debug 401 responses, confirm what claims your identity provider actually issues, or check that refresh logic produces tokens with the expected lifetime. One caveat worth repeating: decoding is not verification. Anyone can read or forge a JWT's contents — only checking the signature against the issuer's key proves authenticity, and that must happen server-side.

Tokens are sensitive credentials, so both tools work entirely in your browser. Nothing you paste is transmitted or logged anywhere — the Base64URL decoding happens locally, which is exactly how inspecting a live production token should work.