JWT Decoder

Inspect the claims in an access or ID token while debugging authentication. The token is decoded on this page and never sent anywhere. This tool does not verify signatures, so never trust a token just because it decodes.

Decoding only. The signature is not verified.

Runs entirely in your browser. Your input and files are not uploaded to any server.

How to use

  1. Paste a JWT (three Base64URL parts separated by dots).
  2. Read the decoded header and payload.
  3. Check exp, iat and nbf, shown in UTC and local time, with a warning when the token has expired.

Examples

Expired token

If exp is in the past, the tool shows “Expired” with how long ago.

Privacy

Your files and text stay in your browser while you use this tool, and ads or anonymous visit statistics do not receive them. Only your favorites and recent tools are saved on your device. Privacy policy

Want proof? Check it with your browser’s Network tab: How to check that a tool does not upload your files

Frequently asked questions

Does it verify the signature?

No. Verifying needs the secret or the public key of the issuer, and should be done by your server. Decoding only shows what the token claims.

Is it safe to paste production tokens?

The token stays in this page and is not stored or transmitted. Still, treat live tokens like passwords and prefer expired or test tokens when you can.

Unix Timestamp ConverterConvert Unix timestamps in seconds, milliseconds or microseconds to readable dates in UTC and your time zone, and convert dates back to epoch time.
Hash Generator (SHA)Generate SHA-1, SHA-256, SHA-384 and SHA-512 hashes and HMAC signatures of text using the browser’s Web Crypto API.
SVG Preview & OptimizerPreview SVG files safely and shrink them by removing comments, editor metadata and whitespace, with optional number rounding.
Color Picker & ConverterPick a colour, convert between HEX, RGB and HSL, sample colours from an image or your screen, and check contrast against white and black text.
Search tools