This tool decodes a token. It does not verify it: a decoded token can still be forged. Never trust claims you have not verified on your server.
| Claim | Date | Relative |
|---|
A JSON Web Token (JWT) is three Base64URL parts joined by dots: a header, a payload of claims and a signature. This tool splits the token, decodes the first two into readable JSON and shows the signature.
Time claims are translated into dates with an expired or valid status. Decoding is not verification: only a signature check with the right key proves a token is genuine, and this page can do that for HMAC secrets.
Everything runs in your browser and nothing is sent anywhere.
Not by default. Decoding only reads the token; anyone can write a payload that looks right. To check a token made with HS256, HS384 or HS512, enter the secret in the Signature section and it is checked in your browser. Tokens signed with RS256, ES256 and similar need the public key and are not checked here.
Decoding runs entirely in your browser and nothing is uploaded or stored. Still, a live token can grant access, so prefer expired or test tokens when you can.
They are Unix times in seconds. The page shows each as a UTC date, as a date in your own time zone, and as a time from now, then says whether the token is expired, not yet valid or still valid.
A signed JWT has three Base64URL parts separated by dots. The first two must decode to JSON objects. The message names the part and, where possible, the character that broke it.
A token with alg set to none has no signature, so anyone could have written it. Servers should reject it.