Free tool · No sign-up
JWT Decoder
Decode a JSON Web Token into its header, payload, and signature without sending it anywhere. Shows every claim, resolves the timestamp claims to real dates, tells you whether the token has expired or is not yet valid, and flags the alg:none footgun. Signature verification against a shared secret is optional and also runs locally.
Paste a JWT (the eyJ… string). Decoding happens in your browser — the token is never sent anywhere.
Method & assumptions
- Decoding reads the header and payload; it does not prove the token is authentic.
- A token can be perfectly valid to decode and still be forged — only signature verification against the right key settles that.
- Time claims (exp, nbf, iat) are seconds since 1970 UTC, shown here in UTC, your local zone, and relative to now.
- Everything runs in your browser. The token and any secret you enter are never transmitted.
Plate —Other tools
More on the bench
- 01Supabase Security AuditorPoint it at your project, find the holes.
- 02Secret & .env ScannerPaste code or a .env, catch the leaked keys.
- 03Security Headers ScannerEnter a URL, grade its headers.
- 04CORS TesterSee exactly what a URL allows cross-origin.
- 05Base64 Encode / DecodeText or files, both directions.
- 06URL Encode / DecodePercent-encoding, both directions.
- 07JSON FormatterValidate, pretty-print, or minify.
- 08UUID Generatorv4 and v7, one or a thousand.
Free diagnosticsSame-day dispatchNamed techniciansDone or free
Need it built, not just checkedWe write the software
We write the software
behind tools like these
Anyone debugging auth and needing to know what a token actually says before trusting it.