A JSON Web Token is three base64url-encoded parts joined by dots: header.payload.signature. This tool splits the token, base64url-decodes the first two parts (UTF-8 safe) and pretty-prints them as JSON. The registered time claims exp (expiry), iat (issued at) and nbf (not before) are also shown as human-readable local time, and an expired token is flagged in red.
Decode only — the signature is displayed as-is and NOT cryptographically verified, so never trust a token's contents based on this tool alone. Everything runs locally in your browser; tokens are never uploaded, making it safe for production credentials.