JWT Decoder
Decode a JSON Web Token's header and claims, see when it expires, and verify its signature (secret or public key). Runs in your browser.
JSON Web Tokens carry sign-in and API permissions (OAuth access tokens, OpenID Connect ID tokens). Reading one shows who issued it, who it's for, what it allows and when it expires: usually the fastest way to debug "401 Unauthorized". Anyone holding a token can use it until it expires, so treat tokens like passwords. Decoding is not validation: a decoded token proves nothing until its signature is checked.
Decoded in your browser. Your token is never sent to tclient.com, stored or logged.
This page runs entirely on your device (WebAssembly), including the HMAC signature check. To confirm, open your browser's developer tools (F12), go to the Network tab and paste a token: no request is made. The token is never put in the page address, so it doesn't end up in browser history or server logs.