Free tools, Developers
JWT decoder
Paste a token to read what's inside and check whether it has expired.
Header
Payload
Questions
Is it safe to paste a token here?
The token is decoded in your browser and never sent anywhere. Still, a valid token works like a password until it expires, so avoid pasting production tokens into any website you don’t trust.
Does decoding verify the token?
No. Anyone can read a JWT’s header and payload. Only the signature proves it wasn’t changed. For HS256, HS384 and HS512 tokens you can enter the secret below to check the signature.
What do exp, iat and nbf mean?
exp is when the token expires, iat is when it was issued, and nbf is the time before which it must not be accepted. All three are Unix timestamps in seconds, shown here as readable dates.
More developers tools
- JSON formatterFormat, validate and minify JSON, with the exact error position.
- Base64 encoderEncode and decode Base64 text, or turn a file into a data URI.
- URL encoderEncode and decode URL components and break a URL into parts.
- Regex testerTest regular expressions with live highlighting and groups.
- Cron expression helperExplains a cron schedule in plain English and shows the next runs.
- Hash generatorMD5, SHA-1, SHA-256 and SHA-512 of text or files.