OmniToolsFree

JWT decoder

Read a JWT header and payload, and highlight expiry. The signature is not verified.

  • 5 MB of text
  • Runs in the browser

The token is decoded in this browser and is not sent anywhere. Do not paste a token you cannot afford to have on this device. Decoding does not mean the token is authentic.

Decoding does not verify the signature. A decoded token can still be forged.

How to use it

Three steps

  1. 01

    Paste a compact JWT.

  2. 02

    Read the header and payload.

  3. 03

    Check the expiry time. This page never claims the signature is valid.

Related tools

JSON formatter

Beautify, minify, validate and optionally sort JSON keys. Errors show a line and column.

Base64 encode and decode

Encode or decode text and files as standard or URL-safe Base64.

Timestamp converter

Convert seconds, milliseconds and ISO dates, then show the result in a time zone.

Questions

Does this verify the signature?

No. It only decodes the header and payload. A decoded token can still be forged or expired.

Should I paste a production token?

Prefer a test token. The value stays in the page, but it is still a credential if it is a real access token.