Runs locally — nothing is uploaded
Result
Nothing yet — enter data or press Example.
How to use
- 1Paste the token (a “Bearer ” prefix is fine).
- 2Check the flags: expired, not yet valid, unsigned.
- 3Read the claims and the decoded JSON.
No. Verification needs the secret or public key; this tool only decodes. Never trust a token's claims before your server has verified it.
The token is decoded in your browser and not sent anywhere. Still, a live token is a credential: prefer expired or test tokens.
A signed JWT (JWS) is only base64url-encoded, not encrypted. Keep secrets out of it, or use JWE if the content must be hidden.
Issued at, not before and expiration time, in seconds since 1970-01-01 UTC. They are shown as dates and relative to now.
Related tools
Subnet calculatorCIDR, netmask, host range and subnets
Cron expression parserExplain cron schedules and see the next runs
Unix timestamp converterEpoch time to date, and date to epoch
Number base converterBinary, octal, decimal, hex and base 36
HTTP status codesSearchable list of all HTTP status codes
MIME types listFind the Content-Type for a file extension
Infrastructure headaches?
Tell us about your stack — we reply within one business day.