Free tool
JWT Decoder
Read the header, payload and expiry of a JSON Web Token without uploading it.
The signature is not checked. Verifying one needs your signing secret, which this page deliberately never asks for.
Paste a JSON Web Token to read its header and payload, and to see when it expires in plain language. The decoding happens in your browser tab, which matters here more than on most tools: a JWT is a credential, and pasting a live one into a site that posts it to a server hands over whatever that token can access.
A JWT is three base64url segments separated by dots: the header names the signing algorithm, the payload carries the claims, and the third segment is the signature. The first two are encoded, not encrypted, so anyone holding the token can read them. Never put secrets in a payload.
- JWT segments are base64url, so the Base64 tool decodes them by hand
- exp and iat are Unix timestamps, which the timestamp converter reads
- the signature is an HMAC, and the hash generator computes those
How to use it
- Paste the token into the input. It should look like three chunks separated by dots.
- The header and payload are decoded immediately, with the standard claims explained below them.
- Check the expiry row to see whether the token is still valid.
- Press Clear when you are done so the token is not left on screen.
Frequently asked questions
Is it safe to paste a real token here?
Safer than most alternatives, because decoding happens in your browser and this page sends no network request. Even so, treat any token you paste anywhere as worth rotating, and prefer the native app for production credentials.
Does this verify the signature?
No. Verifying a signature requires your signing secret or public key, and this tool deliberately never asks for one. It decodes and reads the token. Signature verification is a feature of the Mac app, where the secret stays on your machine.
Is a JWT encrypted?
No. The header and payload are base64url encoded, which is reversible by anyone. The signature proves the token was not tampered with, but it does not hide the contents. Do not store anything sensitive in the payload.
What do exp, iat and nbf mean?
They are timestamps in seconds since 1970. exp is when the token expires, iat is when it was issued, and nbf is the earliest time it may be accepted. This tool converts all three into readable dates.
The desktop version
JWT Decoder in Toolbelt
This page does the job in a browser tab. Toolbelt is the same tool as a native Mac app, plus the things a web page cannot do.
Tools
{
"name": "Holizmi",
"tools": [
"json",
"jwt",
"base64"
],
"live": true
}{
"sub": "12345",
"name": "Henry",
"exp": 1767225600
}019bd4e2-7a10-7c3e-9f21-4a6b8d3e5c07
019bd4e2-7a11-7b8a-8e44-1c2f9a7d6b13
019bd4e2-7a12-7d5f-b0c9-7e3a1f8c2d95 1 1 one
2 2 two
3 + inserted
3 4 three- Verify the signature against your secret, which never leaves the machine
- Watch the clipboard and decode a token the moment you copy it
- Works with no connection, so production tokens never touch a browser
- Keeps a local history you can search, then wipe