How it works
A JWT is three Base64URL parts. This tool decodes the header and payload and shows the issued-at, not-before and expiry times in your local time zone.
Verification
Decoding is not verification. To trust a token you must check its signature with the right key on your server.
Frequently asked questions
Is it safe to paste a token?
Decoding is done in your browser and nothing is uploaded, but still avoid pasting live production tokens into any website.
Why does it say expired?
The exp claim is a Unix timestamp; if it's earlier than the current time the token is expired.
Related tools
JSON Formatter & Validator
Format, minify, validate and sort JSON with clear error positions.
JSON Diff
Compare two JSON documents and see exactly what was added, removed or changed.
Regex Tester
Test regular expressions live with match highlighting and capture groups.
Markdown Previewer
Write Markdown and see the rendered result live.
Base64 & URL Encoder / Decoder
Encode and decode Base64 and URL-encoded text, with full UTF-8 support.
Cron Expression Builder
Build and understand cron schedules, with plain-English descriptions and next run times.