TinySandyFree Online Tools

JWT Decoder

Paste a JSON Web Token to see its header and payload as formatted JSON. Time claims (iat, nbf, exp) are converted to readable UTC and local dates with an expired or valid-for status, and the tool flags risky settings such as the none algorithm. It never checks the signature, and it never sends your token anywhere.

Encoding & Security Runs in your browser

Decode a JSON Web Token

This tool only decodes. It does NOT verify the signature, so a decoded token is not proof that it is genuine. The token never leaves your browser, but do not paste production tokens or secrets into any website you do not control.

How to Use the JWT Decoder

  1. Paste the token (three parts separated by dots). A leading Bearer is removed for you.
  2. Press Decode.
  3. Read the summary for the expiry status and any warnings, then the header, payload and claims table.
  4. Remember: decoding shows what the token says, not whether it is valid. Verify signatures on your server.

About This Tool

Developers debugging authentication, API testers checking claims and expiry, and security reviewers who need to see what a token actually contains.

Input: JWT (header.payload.signature)  ·  Output: JSON + readable times.

Features and Limitations

Features

  • Header and payload decoded from Base64URL as UTF-8 and pretty-printed.
  • iat, nbf and exp shown in UTC and your local time, with a text status such as “Expired 3 days ago” or “Valid for 2 hours”.
  • Warnings for alg none, missing alg, an empty signature and header fields such as jku, x5u or jwk that point to keys.
  • Claims table with plain-language meanings of registered claims.
  • Runs completely offline in your browser.

Limitations

  • Signatures are NOT verified, so nothing here proves the token is authentic or unmodified.
  • Encrypted tokens (JWE, five parts) cannot be read without the key.
  • Expiry status uses your device clock, which may be wrong.
  • Only compact JWTs are supported, not the JSON serialisation.
  • Do not paste production tokens that grant access to real systems into any website.
  • Results are computed in your browser; nothing you enter is sent to a server.

Example

The well-known sample token with {"alg":"HS256","typ":"JWT"} has the payload {"sub":"1234567890","name":"John Doe","iat":1516239022}; iat 1516239022 is 2018-01-18 01:30:22 UTC. It has no exp claim, so it never expires according to its own content.

Frequently Asked Questions

Does this tool verify the signature?

No. Verifying needs the secret or public key and must be done by your server using a trusted library. A decoded token only shows what is written in it, and anyone can write any claims.

Is it safe to paste my token here?

The token is processed in your browser and is not sent anywhere. Still, treat live tokens like passwords: prefer expired or test tokens, and revoke any token you have pasted into a service you do not control.

What do iat, nbf and exp mean?

iat is when the token was issued, nbf is the time before which it must not be accepted, and exp is when it expires. They are seconds since 1970-01-01 UTC, which this tool converts to dates.

Why does the tool warn about alg none?

A token with alg none is unsigned. Servers that accept it let anyone forge tokens, so this is a classic vulnerability.

Why does it say my token has the wrong number of parts?

A signed JWT has exactly three Base64URL parts separated by dots. Five parts means an encrypted JWE; anything else is probably truncated or not a JWT.

Related Tools

More like this: all Encoding & Security tools, all Developer & Web tools or the TinySandy home page.