Paste a JWT to see its header, payload, and human-readable issue and expiry times.
Free, no sign-up. Runs in your browser: nothing is uploaded.
Your files are opened and processed by your browser on this device. They are never uploaded to openWorkstand or anyone else, so the JWT Decoder is safe for contracts, IDs, photos and work documents, and it keeps working offline once the page has loaded. How local processing works
Paste a token to see its header and payload. Here, iat and exp show it was issued on 7 October 2026 at 00:00 UTC and expires one hour later (times are shown in your own time zone). The signature part is not checked.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFkYSIsImlhdCI6MTc5MTMzMTIwMCwiZXhwIjoxNzkxMzM0ODAwfQ.signatureHeader: { "alg": "HS256", "typ": "JWT" }
Payload: { "sub": "user_42", "name": "Ada", "iat": 1791331200, "exp": 1791334800 }Part of the token is missing or changed. Copy the whole token again, without surrounding quotes or line breaks (a “Bearer ” prefix is removed for you).
Expiry is compared with your computer’s clock. Check the clock, and remember that servers often allow a small clock skew.
Check that it is one of the supported formats above and opens in another app. Damaged files and password-protected PDFs cannot be read until they are repaired or unlocked.
Everything runs on your device, so speed depends on its memory. Close other tabs, use a computer rather than a phone, or split the file into smaller parts first.
Look for your browser’s download bar or icon. Some browsers ask once before a site may download files; allow it and click the button again.
No. Verification needs your secret or public key, which should never be pasted into a website.
After you download, choose “Save to Workstand” to keep the result in a folder on your computer, attach it to a project and create a follow-up task. It is saved by your browser, not uploaded.