Decode a JWT’s header and payload locally, with human-readable claim timestamps and expiry checks. The token never leaves your browser.

Runs entirely in your browser — nothing you paste leaves this page.