Skip to content
TechnologyTools

Developer Tools

JWT Decoder

Read a JSON Web Token header and payload locally. Decoding does not verify the signature.

Decoding Is Not Verifying

A JSON Web Token is three Base64URL parts: header, payload, signature. Decoding exposes the claims — subject, expiry, issuer — but says nothing about authenticity. Anyone can craft a token with any payload; only the signature, checked with the issuer's key, proves it. This tool deliberately decodes and stops: signature verification requires the secret or public key and belongs in your backend.

The most common production bug hides in the exp claim: it counts seconds since epoch, not milliseconds. Reading a decoded exp of 1,800,000,000 as "expired" when your library compares in milliseconds — or the reverse — produces auth loops that look like clock skew.

How the Tool Works

  1. Paste a JSON Web Token — the three dot-separated base64url sections (header.payload.signature).
  2. The header is decoded to show the signing algorithm (alg) and token type (typ).
  3. The payload is decoded into a readable JSON object where standard claims such as iss, sub, exp, and iat are highlighted.
  4. Expiration/issued-at timestamps are converted to human-readable local time so you can judge validity at a glance.

Example Input & Output

Inspect a session token
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0IiwiaWF0IjoxNzI2MDAwMDAwfQ…
Output: Header: RS256/HS256 • Payload: sub, iat, exp converted to dates
Decoding reveals which claims the token carries and when it expires — useful when debugging authentication failures.
Check exp vs iat
Input: Payload {iat:1726000000, exp:1726086400}
Output: iat 2024-09-10 12:26:40 → exp 2024-09-11 12:26:40 (24h lifetime)
Comparing the two timestamps in local time makes it obvious whether a token is already expired or still valid.

Common Questions

Does this tool verify the signature?

No. The signature cannot be verified without the secret key or public key. This tool only decodes the header and payload — treat any data you paste as readable by anyone.

Is it dangerous to paste a token here?

The decode happens locally and nothing is transmitted, but you should still avoid pasting live production tokens out of habit: JWTs are not encrypted, only signed.

What is base64url?

Base64 with URL-safe characters (- and _ instead of + and /) and no padding. It is the encoding JWT parts use so they fit safely in URLs and headers.

Developer Toolspopular

JSON Formatter & Validator

Professional developer utility to format, validate, and minify JSON with precise line/column syntax error detection and payload size statistics.

Developer Tools

Unix Timestamp Converter

Translate epoch timestamps and ISO dates while showing UTC and local browser time.

Developer Toolspopular

Regex Tester & Debugger

Experiment with regular expressions, inspect every matched occurrence and named capture group, and test replacements with zero server transmission.