A quick way to read what's inside a JWT (JSON Web Token) when you're debugging an API or chasing down an auth issue: paste it in and see the decoded contents. It splits the three base64url parts of `header.payload.signature` and pretty-prints the header and payload as indented JSON. The header's `alg` (HS256, RS256, etc.) and `typ` are shown next to the heading, and time claims in the payload — `exp` (expiry), `iat` (issued-at), `nbf` (not-before) and `auth_time`, stored as Unix seconds — are converted into readable dates in your local timezone. If `exp` is in the past it's flagged as "expired", and if `nbf` is in the future it's flagged as "not valid yet", so you can tell at a glance whether a token is still good. A leading `Bearer ` prefix is stripped automatically, so you can paste a value copied straight from an Authorization header. Because JWTs often carry access tokens, sessions and personal data (emails, user IDs), this tool does all of its decoding entirely inside your browser — your token is never uploaded, stored, or sent to a server. Note that this tool does **not verify the signature**: verification needs the issuer's secret key (HS256) or public key (RS256/ES256), and handling those in a web page would be unsafe. Use decoding to inspect a token's contents, and verify on the server with a proper library.