JWT decoder
See what is inside a JSON Web Token, without sending it anywhere.
A JWT is three base64 sections joined by dots, and the middle one is readable by anyone holding the token. This decodes it and reads the dates back in words, including whether it has expired. It does not check the signature, and no browser tool honestly can: that needs the secret key, which belongs on a server. Pasting a live token into somebody else site hands them the token; here it stays on your machine.
How to use it
- Paste the token.
- Read the header and payload.
- Check the expiry line.
Why use this tool
Completely private
Everything runs inside your browser. Your files and text are never sent to a server.
Free, with no limits
No sign-up, no watermarks and no cap on how many times you can use it.
Instant results
There is no upload or queue to wait for, so results appear as fast as your device can work.
Works on any device
Runs in any modern browser on phone, tablet or desktop. Nothing to install.
Frequently asked questions
- Why will it not verify the signature?
- Verification needs the signing secret. Any site offering to verify a token is asking you to paste a production secret into a web page, which is a worse idea than the problem it solves. Decoding tells you what the token claims; only your server can tell you whether the claim is genuine.
- Is it safe to paste a real token here?
- Safer than elsewhere: the decoding happens in your browser and nothing is sent to us. You can prove it by disconnecting from the internet after the page loads. Even so, a token is a credential, so treat it like one.
- What do exp, iat and nbf mean?
- Expiry, issued-at and not-before, each a count of seconds since 1970. They are shown here as ordinary dates in your own time zone, which is the quickest way to spot a clock problem.
Related tools
Base64 encoder / decoder
Encode text to Base64 or decode it back, with full Unicode support.
JSON formatter
Format, validate and tidy JSON with clear error messages.
Hash generator
Get the SHA-256 or SHA-512 fingerprint of any text.
Unix timestamp converter
Turn a Unix timestamp into a readable date, and back.
URL encoder and decoder
Escape text for a URL, or read an escaped one back.
Number base converter
Convert a number between binary, octal, decimal and hex.
Password generator
Create strong random passwords that never leave your device.