Read the header, payload and expiry of a JSON Web Token in your browser.
A JWT has three Base64URL-encoded parts: a header (the signing algorithm and token type), a payload of claims, and a signature. Common claims are sub (the user), iat (issued at), exp (expires at), iss (who issued it) and aud (who it's for). Times are Unix timestamps in seconds; the decoder turns exp into a date in your local time and tells you whether it has passed.
The payload is only encoded, not encrypted. Anyone who has the token can read it, which is why tokens should never hold passwords or other secrets.
This tool shows what a token says. It does not check the signature, because that needs the secret or public key the token was signed with. A server must always verify the signature before trusting any claim. To create test tokens signed with your own secret, use the JWT Generator.
The token is decoded in your browser and not sent to any server. Still, treat live tokens like passwords and prefer expired or test tokens when you can.
A JWT needs exactly three parts separated by dots. Check that you copied the whole token without the word Bearer or extra spaces. Encrypted tokens (JWE) have five parts and can't be read without the key.
No. It decodes the header and payload only. Signature checks belong on your server, with the real key.
Your device's local time zone. The exp value itself is in UTC seconds.
OneClickly is a set of 119 free tools for PDFs, images, text, everyday math and code. They run in your browser, so the files and text you work with stay on your device.