fjordtools / Security / JWT Decoder
JWT Decoder
Decode a JSON Web Token to see its header, payload and expiry time. The token never leaves your browser.
About JWT Decoderhow it works and good to know
What is in a JWT
A JSON Web Token is three Base64URL parts separated by dots: a header that names the signing algorithm, a payload of claims such as the subject and expiry, and a signature. The first two parts are only encoded, not encrypted, so anyone holding the token can read them.
Expiry and time claims
The decoder converts exp, iat and nbf to dates in your time zone and tells you whether the token is expired, active, or not yet valid.
This tool does not verify signatures
Checking a signature needs the secret or public key, and the decoded contents of an unverified token must never be trusted for access decisions. Use this page to inspect tokens while debugging. Verification belongs on your server.
Related tools
- Base64Encode and decode text, with URL-safe and UTF-8 support.
- JSON FormatterFormat, validate, minify and sort JSON.
- Hash & HMACMD5, SHA-1, SHA-256, SHA-384, SHA-512 and HMAC for text and files.
- Timestamp ConverterUnix time to dates and back, in any time zone.
- UUID & ULIDGenerate UUID v4, v7 and ULID, and read the time inside any ID.
- Password GeneratorRandom passwords, hex and base64url secrets, with entropy shown.