JWT Decoder

Decode JSON Web Tokens: header, payload and their dates.

About this tool

Look Inside a JSON Web Token

Header and payload are decoded into readable JSON, and the exp, iat and nbf dates are shown as real dates — including whether the token has expired. The token stays in your browser.

How to use it

  1. Paste the JWT (header.payload.signature).
  2. Read the header, the payload and the dates.
  3. Copy the header or payload if you need them elsewhere.

Frequently asked questions

Is my data sent anywhere?

No. Every tool runs in your browser. Tokens, passwords and files are processed on your device and never uploaded.

Can I link to a tool?

Yes. Each tool has its own address, for example toolula.com/dev/regex-tester, and you can star tools to keep them at the top of the list.

Does the JWT decoder check the signature?

No. It decodes the header and payload and shows their dates; checking the signature needs the secret or public key.

Are the generated passwords and UUIDs random enough?

Yes. They come from the browser's cryptographic random generator (crypto.getRandomValues / randomUUID), the same source used for keys.