SITE UNDER CONSTRUCTION. Everything here is provided AS IS, WITHOUT WARRANTIES, to the extent the law allows. It is information, not professional advice. Use at your own risk. Terms and liability limits →

eThorns ES
Menu
Buy us a coffeeEspañoleThorns 2026 · Made in Colombia
← DeveloperES

Tool 5.13

JWT decoder: read JWT header, payload & expiry

Decode a JSON Web Token in your browser: see the header and payload as formatted JSON and whether it has expired. The token is never sent anywhere.

Runs on your deviceRuns entirely in your browser: nothing you type or upload leaves your device.

How to use it

  1. Paste the token (with or without 'Bearer ').
  2. Read the header and payload, and check exp, iat and nbf in your local time.
  3. Remember that the signature is not verified here: your server must do that.

What a JWT carries, and why you'd open one

A JWT (JSON Web Token) is the long string that starts with eyJ and that many apps use to keep you logged in or to let one system call another. It has three parts separated by dots: a header saying how it was signed, a payload with the data, called claims, and a signature.

Developers decode it to see why a login fails, which roles or permissions a user has, or when a session expires. The first two parts are only Base64URL-encoded JSON, not encrypted, so they can be read without any key.

Example: a token that lived one hour

Paste a token whose payload is {"sub":"1234","name":"Pepito Pérez","iat":1735689600,"exp":1735693200}. The status line says ✗ Expired and how long ago. The table converts the times: iat (issued at) and exp (expires) are one hour apart, so the token was valid for one hour.

The Your local time column shows them in your own time zone. In Colombia, UTC−5 all year, that is Tuesday 31 December 2024 from 7:00 to 8:00 p.m., even though in UTC it was already 1 January. Keep that in mind when a log in UTC and a user's report in local time seem to disagree.

Milliseconds, personal data and fake tokens

If exp shows a date tens of thousands of years away, the system that created the token wrote milliseconds instead of seconds: 1735693200000 read as seconds lands in the year 56971. JWT times are always in seconds since 1970.

Anyone who has the token can read its payload, so never put a password, an ID number, a phone number or other personal data in it. And a token that decodes fine may still be fake: this page doesn't check the signature. Only your server, with the right key, can say whether a token is genuine.

FAQ

Is it safe to paste a production token here?

The token is decoded by JavaScript on your device and is never sent or stored. Still, a valid token works like a password: handle it with care and use expired or test tokens when you can.

Why doesn't it verify the signature?

Verifying needs the secret or public key, and calling a token 'valid' without it would be misleading. Anyone can create a token with any content, so trust its claims only after your server has verified the signature.

Can it read encrypted tokens (JWE)?

Only the header. The payload of a JWE is encrypted and can't be read without the decryption key.

Why does a brand-new token show as not valid yet or expired?

Usually a clock problem. If the server's clock is ahead of yours, nbf can be a few seconds in the future; if your computer's date is wrong, a fresh token can look expired. Check the device's date and time, and allow a small tolerance on the server.

What do sub, iss and aud mean?

They are standard claims defined in RFC 7519: `iss` (issuer) is who created the token, `sub` (subject) is who it is about, usually a user ID, and `aud` (audience) is the service it is meant for. `jti` is a unique ID for the token. The table converts only the three time claims, `exp`, `iat` and `nbf`; the rest appear as they are in the payload.

  • 5.1JSON formatterFormat or minify JSON and find syntax errors by line and column.
  • 5.2CSV to JSON converterConvert CSV to JSON or JSON to CSV with comma, semicolon or tab separators.
  • 5.3YAML to JSON converterConvert YAML to JSON and back in your browser.
  • 5.4Base64Encode or decode Base64 in your browser: UTF-8 text, URL-safe Base64, files to Base64 or data URLs, and Base64 back to a downloadable file.
  • 5.5Color contrast checkerCheck the contrast ratio of a text color on its background against WCAG 2.2 AA and AAA, for normal text, large text and UI components.
  • 5.6Cron explainerRead a 5-field cron expression as a plain sentence and see its next 5 run times in your time zone.
  • 5.7Number base converterConvert whole numbers between decimal, hexadecimal, binary and octal, with bit length and grouped digits.
  • 5.8HTML entity encoderEncode text as HTML entities (named, decimal or hex) or decode entities back to text: <, >, &, quotes, Spanish accents, Latin-1 symbols.
  • 5.9URL encodePercent-encode or decode URLs and query values, and break any URL into protocol, host, path, query parameters and fragment.
  • 5.10SHA-256 hashGet SHA-1, SHA-256, SHA-384 and SHA-512 hashes of text or files and verify a download against its published checksum.
  • 5.11UUID generatorGenerate random UUID v4 or time-ordered UUID v7 (RFC 9562) in your browser, 1 to 1000 at a time, in uppercase or without dashes.
  • 5.12Unix timestampConvert Unix timestamps in seconds or milliseconds to ISO 8601, UTC and your local time, or a date back to epoch.
  • 5.14Regex testerTest regular expressions live: highlighted matches, capture and named groups, flags and clear errors.

╌╌ END ╌╌