ToolFox

JWT Decoder

Decode a JWT into its header and payload as pretty JSON, plus an expiry check — no signature verification, nothing leaves your browser.

How it works

A JSON Web Token has three dot-separated parts — header, payload and signature — each Base64url-encoded. This tool splits the token on the dots, reverses the Base64url encoding (swapping URL-safe characters back and padding as needed) and parses the resulting bytes as UTF-8 JSON, showing the header and payload side by side. It reads the exp (expiry) claim, if present, and converts it from a Unix timestamp into a local date so you can see at a glance whether the token has expired.

Example

Paste a token like eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMiLCJleHAiOjE3MDAwMDAwMDB9.signature and the header {"alg":"HS256"} and payload {"sub":"123","exp":1700000000} appear as formatted JSON, with the expiry shown as a readable date and an expired/not-expired flag.

Frequently asked questions

Does this verify the token's signature?

No. This tool only decodes the header and payload — it never checks the signature, so it cannot tell you whether the token is authentic or was tampered with. Use a library with the correct secret or public key for real verification.

Is my token sent to a server?

No — decoding happens entirely in your browser using Base64url and JSON parsing built into JavaScript; the token never leaves your device.

Why does it show exp as a date?

The exp claim is a Unix timestamp in seconds since 1970. Converting it to your local time makes it easy to see whether the token has already expired.

What if the token has no exp claim?

Not all tokens set an expiry. The tool shows "No expiry (exp) claim in this token" instead of a date in that case.

Related tools