Tools

JWT decoder

Read a token's header and claims, and see whether it has expired.

Runs in your browserEncoding18.2K
Free

Input

0 BFree up to 20.0 KB

Result

The result will appear here.

Decodes the header and payload of a JSON Web Token and shows the timestamps as readable dates, so you can tell at a glance whether a request is failing because the token expired or because it was never valid. Decoding happens in your browser, and nothing about the token is stored — a JWT is a bearer credential, and anyone holding it can act as its subject.

How it works

  • The two Base64URL segments are decoded and shown as formatted JSON.
  • exp and iat are rendered as ISO timestamps, with the token marked expired or valid.
  • Nothing is transmitted and nothing is stored, including in your own run history.

Where your data goes

Nowhere. This tool runs entirely in your browser: the text you paste is processed by the page and is never transmitted to a server or written to a log.

This tool handles keys and credentials, so nothing about a run is saved, not even to your own history.

What it costs

Free up to 20.0 KB per run without an account. Past that, a run costs 1 points and is saved to your history.

Points come from signing up, checking in daily, commenting and completing your profile.

See how points work

Common questions

Does this verify the signature?
No. Verification needs the signing key, and pasting a signing key into a web page is exactly the habit that leaks them. This tool reads the token; verify signatures in your own service.
Is a JWT encrypted?
Not in the common form. A signed JWT is Base64URL-encoded and readable by anyone who has it — the signature proves it has not been altered, not that it is private. Never put anything secret in a JWT payload.
Why does my token fail even though exp is in the future?
Check nbf (not before) and the clock on the machine issuing the token. A few seconds of clock skew between issuer and verifier rejects tokens that look perfectly valid.

The open-source behind it

This tool is a self-contained implementation. auth0/node-jsonwebtoken (MIT) does the same job as a library — if you need this behaviour inside your own program, start there rather than calling a web page.

auth0/node-jsonwebtoken

Also known as

  • jwt decoder
  • decode jwt
  • jwt parser
  • json web token decoder
  • jwt expiry check