Input
Result
The result will appear here.Decodes the header and payload of a JSON Web Token and shows the timestamps as readable dates, so you can tell at a glance whether a request is failing because the token expired or because it was never valid. Decoding happens in your browser, and nothing about the token is stored — a JWT is a bearer credential, and anyone holding it can act as its subject.
How it works
- The two Base64URL segments are decoded and shown as formatted JSON.
- exp and iat are rendered as ISO timestamps, with the token marked expired or valid.
- Nothing is transmitted and nothing is stored, including in your own run history.
Where your data goes
Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.
This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.
What it costs
Free up to 20.0 KB per run without an account. Past that, a run costs 1 points and is saved to your history.
Points come from signing up, checking in daily, commenting and completing your profile.
See how points workCommon questions
- Does this verify the signature?
- No. Verification needs the signing key, and pasting a signing key into a web page is exactly the habit that leaks them. This tool reads the token; verify signatures in your own service.
- Is a JWT encrypted?
- Not in the common form. A signed JWT is Base64URL-encoded and readable by anyone who has it — the signature proves it has not been altered, not that it is private. Never put anything secret in a JWT payload.
- Why does my token fail even though exp is in the future?
- Check nbf (not before) and the clock on the machine issuing the token. A few seconds of clock skew between issuer and verifier rejects tokens that look perfectly valid.
The open-source behind it
This tool is a self-contained implementation. auth0/node-jsonwebtoken (MIT) does the same job as a library — if you need this behaviour inside your own program, start there rather than calling a web page.
auth0/node-jsonwebtokenAlso known as
- jwt decoder
- decode jwt
- jwt parser
- json web token decoder
- jwt expiry check