ToolDeck

JWT decoder

Decode a JSON Web Token’s header and payload and read exp, iat and nbf as dates.

Runs in your browser. Your input is not uploaded.

What it does

A JSON Web Token has three Base64URL parts separated by dots: a header (algorithm and type), a payload of claims, and a signature. The header and payload are encoded, not encrypted, so anyone holding the token can read them.

The decoder shows both parts and turns the time claims exp, iat and nbf into dates. The signature is not checked. Do not treat a decoded token as trusted.

How to use it

  1. Paste the token. A leading Bearer is removed.
  2. Read the header, payload and the expiry line.
  3. Check the warnings, such as an expired token or alg: none.

Things to watch for

  • Decoding is not verification. A forged token decodes just as cleanly. Verify signatures in your server code with the right key.
  • exp is in seconds. A value with 13 digits is milliseconds, which is a bug in whatever issued it, and is flagged.
  • A token with five parts is an encrypted JWE. Its payload cannot be read without the key.

Guides

Questions

When does this JWT expire?
The exp claim is shown as a UTC time, your local time and how long from now.
Is it safe to paste a production token?
This page does not send it anywhere; you can check the network panel. A live token is still a credential, so treat it like a password.
Does this verify the signature?
No. The signature is not checked, and there is no option to do so.
What does alg none mean?
The token claims to be unsigned. Servers must reject it; accepting it is a known vulnerability.
Can I edit and re-sign a token?
No. ToolDeck does not create tokens.