JWT Decoder

Paste a JSON Web Token to read its claims, check if it has expired and verify HMAC signatures — privately.

How to use JWT Decoder

Readable claimsexp, iat and nbf are shown as local dates with an expired badge.
Signature checkVerify HS256, HS384 and HS512 tokens with your secret.
Safe for real tokensDecoding happens locally — tokens are never sent to a server.

Is it safe to paste production tokens?

Yes. Nothing is uploaded; the token is decoded with JavaScript in your browser. Still, avoid sharing tokens in screenshots.

Why can’t it verify RS256 tokens?

RS256/ES256 need the issuer’s public key. Only HMAC-signed tokens can be verified with a shared secret here.

Does decoding mean the token is valid?

No. Anyone can decode a JWT; only a verified signature proves it’s authentic.

Convert text and files to Base64 and back. UTF-8 safe, URL-safe variant and data URL output included.

Beautify, minify and validate JSON instantly with syntax highlighting and precise error locations.

Turn epoch timestamps into readable dates and back — with automatic unit detection and a live clock.

Turn JSON into spreadsheets and spreadsheets into JSON — nested objects flattened, Excel-ready output.

Percent-encode text for safe URLs or decode %-sequences back to readable text, with a query-string breakdown.

Compute MD5 and SHA checksums for text or any file — and check a download against its published hash.