Decode a JSON Web Token’s header and claims — with readable expiry times — privately, without sending it anywhere.
Decoded entirely in your browser — the token is never sent anywhere. This tool reads a token; it does not verify the signature.
● ActiveExpires 3/17/2030, 5:46:40 PM
Standard claims
Subject
1234567890
Issued at
1716239022 · 5/20/2024, 9:03:42 PM
Expires
1900000000 · 3/17/2030, 5:46:40 PM
Header
Payload
Runs in your browser. Files are never uploaded — you can go offline after the page loads.
How to use the JWT Decoder
Paste a JSON Web Token.
Read the decoded header and payload, with readable times.
Check the Active / Expired status at a glance.
Easy to use
Drop files, pick options, download. Whole folders at once, no signup, no daily limit.
Best quality
The same engines the professionals use — SVGO, resvg, MozJPEG, libwebp, libavif — compiled to run in your browser.
Private & secure
Files are processed on your device and never uploaded. Close the tab and nothing remains anywhere.
See inside a token
A JSON Web Token is three Base64URL parts — header, payload and signature — joined by dots. This tool decodes the
first two into readable JSON, turns the exp, iat and nbf timestamps into local times, and shows whether the token is
currently valid. It is the fast way to check what claims a token carries and when it expires.
Decoding happens entirely in your browser, so the token — which is a credential — is never sent anywhere. Note that
this reads a token; it does not verify the signature, which needs the issuer's key. Never trust a token's claims on
decoding alone. For the raw Base64 pieces, see Base64 Encode / Decode.
Frequently asked questions
Is my token uploaded?
No. Decoding is pure Base64URL + JSON parsing done in your browser, so even a live access token stays on your device — important, because a JWT is a credential.
Does it verify the signature?
No. This tool reads a token so you can inspect its contents; it does not check the signature, which requires the issuer’s secret or public key. Never trust a token’s claims on the strength of decoding alone.
Why does it say expired?
The payload’s exp claim is a Unix timestamp; the tool compares it to now and shows Expired, Active or Not-yet-valid, plus the exact local time.
Most online converters upload your file to a server. InfyTool ships the actual encoders to your browser as WebAssembly instead, so processing happens inside your tab — faster for batches, and nothing to delete afterwards.
No upload, ever. Turn off Wi-Fi after the page loads and every tool keeps working.
No limits. No file-size cap, no queue, no watermark, no account.
Runs on your CPU. Batches use several cores in parallel; nothing is throttled.