Loading tool…
Decode JWT header and payload, check expiry and verify HMAC signatures locally.
A JWT decoder splits a JSON Web Token into its three base64url segments and prints the header and payload as readable JSON. You can see at a glance who issued the token, what claims it carries, and exactly when it expires, without running a command or visiting an external site.
Decoding and signature checks run entirely in your browser with the built-in Web Crypto API. The token and any secret you enter are never uploaded, so it is safe to inspect tokens from production systems, staging environments, or private clients.
Decode a valid access token
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTc5MTQ1MTM1NCwiZXhwIjoyMTA2ODE0OTU0fQ.EsxOo7w1qKUqr-9JcKArMZcIfddINL_C0FVBm2vH5lUOutput
{
"sub": "user_42",
"name": "Ada Lovelace",
"role": "admin",
"iat": 1791451354,
"exp": 2106814954
}The status line shows alg HS256 and a live countdown to exp. Enter the secret ild-demo to verify this example's signature.
Spot an expired token
Input
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyXzQyIiwibmFtZSI6IkFkYSBMb3ZlbGFjZSIsInJvbGUiOiJhZG1pbiIsImlhdCI6MTcwMDAwMDAwMCwiZXhwIjoxNzM1Njg5NjAwfQ.Pu-EWSegfO3CwgkfmX6K5u8ITUJbOhUodXXwrxN2UcAOutput
{
"sub": "user_42",
"name": "Ada Lovelace",
"role": "admin",
"iat": 1700000000,
"exp": 1735689600
}exp and iat are Unix timestamps in seconds. The tool converts them for you and flags the token as expired.
No. Decoding uses base64url decoding and JSON parsing in your browser, and signature checks use the local Web Crypto API, so nothing you paste leaves your device.
They are standard time claims stored as Unix timestamps in seconds: exp is expiry, iat is issued-at, and nbf is not-before. The tool turns them into relative times like "expires in 4h 12m".
HMAC tokens — HS256, HS384 and HS512 — when you paste the shared secret. RSA and ECDSA signatures need the issuer's public key, so those tokens can be decoded here but not verified.
Encrypted tokens (JWE) have five segments and are ciphertext throughout; they need the decryption key to read. This tool handles signed JWTs, which have three segments.