JWT
Decode a JSON Web Token's header and claims, with expiry and issued-at shown as real dates.
Runs in your browser — nothing you type here is sent anywhere.
Token — decoded here in your browser, never sent anywhere
Paste a JWT to read its header and claims.
A JWT is three base64url segments, so the contents are readable by anyone holding the token — decoding is not the same as verifying, and the payload was never private. What you usually want is to see the claims and check whether the thing has expired.
Paste a token and the header and payload are laid out as formatted JSON, with `exp`, `iat` and `nbf` converted from epoch seconds into dates and an obvious note when it is expired. The token is decoded in your browser and is not sent anywhere, which matters given what tokens tend to grant.
What people open it for
- Checking whether an access token has expired and when it was issued
- Reading the scopes or roles inside a token during debugging
- Inspecting the algorithm and key id in a token's header
In the terminal
jwt <token>
Every utility is also a command in the desktop's shell.