Decode, analyze and validate JSON Web Tokens (JWT) locally
{
"alg": "HS256",
"typ": "JWT"
}{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"exp": 1916239022
}191623902215162390221234567890eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE5MTYyMzkwMjJ9SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cHop to nearby dev utilities without losing context.
Quick steps so you can get results fast.
Paste a JWT (three Base64URL parts separated by dots).
The header shows the signing algorithm (alg) and token type.
Claims such as sub, iss, aud, iat and exp are shown as formatted JSON; times are converted to readable dates.
The tool shows whether the token has expired and how long it has left.
Everything you need to know about JWT Decoder.
Answers to the most common devtool questions.
No. Anyone can create a token with any payload. Only signature verification with the right key, done by your server, proves it was issued by you.
Decoding happens in your browser and the token is not sent to ToolzStack. Treat live tokens like passwords anyway: prefer expired or test tokens when debugging.
No. This tool runs in your browser with JavaScript, and what you type or paste is not sent to ToolzStack servers. Page visits are measured with Google Analytics, as described in the Cookie Policy.
Your input stays in the page while it is open. A few tools keep a short history or favourites in the local storage of this browser; you can clear it in the tool or in your browser settings.
Use Report a Bug on the page or the contact form, and include a sample input that shows the problem (remove anything sensitive first).