Base64 encoder and decoder
Encode text to Base64 or decode it back.
JWT decoder
Read the header and payload of a JSON Web Token and see when it expires.
Your files stay on your device
How it works
- 1Paste the token. A leading "Bearer " is fine.
- 2Read the decoded header and payload.
- 3Check the algorithm, issued-at and expiry tiles.
- 4Copy the JSON you need.
Privacy
The token is decoded in your browser and is never sent to a server. Even so, treat live tokens as secrets and prefer test tokens when you can.
Questions people ask
Does this verify the signature?
No. It only decodes. Verifying needs the secret or public key, and should be done by your server. A decoded token is not proof that it is genuine.
Is it safe to paste a production token?
Decoding happens locally and nothing is uploaded, but anyone with a valid token can use it until it expires. Do not paste live tokens into any page you do not trust, and revoke one if it leaks.
What do exp, iat and nbf mean?
exp is the expiry time, iat is when it was issued, and nbf is the time before which it must not be accepted. All are Unix times in seconds, shown here as UTC dates.
Why does it say a JWT has three parts?
A JWT is header.payload.signature, each part Base64URL encoded and joined by dots. A token with two parts is unsigned, and one with five parts is an encrypted JWE that cannot be read without a key.
Is the payload encrypted?
No. A normal signed JWT is only encoded. Anyone holding it can read the payload, so never put secrets in one.