How to use the JWT decoder
Paste a token into the editor. Choose Decode to read the Base64URL header and payload as JSON. If the payload has an exp claim, it is shown as a local date and time. Use Copy JSON to copy both parts. Signatures are never verified.
Frequently asked questions
What does a JWT decoder do?
It splits a token on dots, Base64URL-decodes the first two parts, and pretty-prints them as JSON so you can inspect claims.
Does this tool verify JWT signatures?
No. Decoding is not verification. A decoded token can still be forged, expired, or intended for another audience.
Is my token uploaded or stored?
No. All decoding happens in your browser. Deskutil never receives the token.
How is the expiration time shown?
A numeric exp value is treated as Unix seconds and formatted in your local timezone. Invalid or missing exp values are explained in the status line.