websystemer / jwt-decoder
JWT Decoder
Decode a JSON Web Token to see its header, payload and expiry time. The token never leaves your browser.
What is in a JWT
A JSON Web Token is three Base64URL parts separated by dots: a header that names the signing algorithm, a payload of claims such as the subject and expiry, and a signature. The first two parts are only encoded, not encrypted, so anyone holding the token can read them.
Expiry and time claims
The decoder converts exp, iat and nbf to dates in your time zone and tells you whether the token is expired, active, or not yet valid.
This tool does not verify signatures
Checking a signature needs the secret or public key, and the decoded contents of an unverified token must never be trusted for access decisions. Use this page to inspect tokens while debugging. Verification belongs on your server.
More tools
- JSON FormatterFormat, validate, minify and sort JSON.
- Base64Encode and decode text, with URL-safe and UTF-8 support.
- URL EncoderPercent-encode, decode and take apart URLs and query strings.
- Timestamp ConverterUnix time to dates and back, in any time zone.
- Cron ExplainerPlain-English meaning and the next run times of a cron schedule.
- Regex TesterTest JavaScript regular expressions with live match highlighting.
- Color ToolsConvert HEX, RGB and HSL, and check WCAG contrast.