How it works
Split the token on dots. The first two segments are Base64URL-encoded JSON; the third is binary signature data. This tool decodes the header and payload, pretty-prints the JSON and converts iat and exp from Unix seconds into readable dates. It never verifies the signature.
- The signature is not checked: this is a decoder, not a validator. Never paste production secrets into any online tool, including this one.
Why it matters
Most JWT bugs are not cryptographic. They are expired tokens with confusing timelines, claims read in the wrong unit, or payloads trusted by a client that never checked the signature. Reading the token correctly answers most of those questions immediately.
A worked example
The payload of a typical access token contains sub, iat and exp. Decoding shows the claims as JSON and converts exp from seconds to a readable date, which immediately explains an "expired" error that looked like a server bug.
Common mistakes
- Reading claims and skipping signature verification entirely.
- Pasting production tokens into any online tool.
- Confusing millisecond timestamps with JWT second-based exp.
Practical tips
Debug with tokens issued by a development tenant, never production. Remember that revoking a JWT usually requires server-side state; short expiries plus refresh tokens are the practical alternative to blacklists.
How to use it
- Open the tool. Everything runs in your browser tab.
- Paste or type your input, then choose the action you need.
- Check the result and copy it with one click.
Common questions
Does it verify the signature?
No. It only decodes the token. Never treat the decoded claims as trusted without verifying the signature server-side.
Why does my token look expired?
Check the exp claim against the current time; clock skew between machines is a common cause of rejected tokens.
Is it safe to paste production tokens?
Prefer test tokens. Decoding happens locally, but a token is still a credential once it leaves your clipboard.
Is this tool really free?
Yes. There is no account, no paywall and no usage limit. Tools App is funded by aumenso, the studio behind it.
Is anything I enter uploaded?
No. The tool runs in your browser tab; what you enter is never sent to us and never stored.