Toolkeel

JWT decoder

Inspect JSON Web Tokens while debugging authentication. See the algorithm, the claims and when the token expires, without pasting a live token into a third-party server.

  • Free
  • Private
  • No sign-up
Stays on this device. Network requests since you started: 0 How to check this yourself
  1. Your text and dataRead from your device
  2. Worked on in this tabBy code running in your browser
  3. Ready to copyNothing is stored

Never sent to a server. See how to check

How to use it

  1. Paste a token.

  2. Read the header, payload and the times table.

  3. Check warnings about expiry or unsigned tokens.

About this tool

A JWT has three Base64URL parts separated by dots: a header (the signing algorithm), a payload (the claims, such as user ID and expiry) and a signature. This tool decodes the first two and converts the exp, iat and nbf timestamps into readable dates.

Decoding is not verifying. Anyone can create a token with any payload; only checking the signature with the right key proves it is genuine. Do that on your server with a maintained JWT library. Because tokens can grant access to accounts, this decoder never sends them anywhere.

Good to know

  • Does not verify signatures.
  • Encrypted tokens (JWE, five parts) cannot be decoded without the key.

Frequently asked questions

Is it safe to paste a JWT here?

The token is decoded in your browser and never transmitted. Still, treat live tokens like passwords and revoke any that may have leaked.

Why does it say the signature is not verified?

Verification needs the secret or public key. Decoding only reads the contents, which are not secret.

What does "exp" mean?

The expiry time, in seconds since 1 January 1970 (UTC). The tool shows it as a normal date.

You might also need

Last updated 2026-10-20 by the Toolkeel team. How we build and check our tools.