JWT decoder
Paste a token and see what is inside it. The expiry is shown in your own timezone and as a relative time.
The signature is not checked, and the token never leaves this page. Both of those are said again on the tool itself, because a decoder that looks like a validator is how production tokens end up pasted into other people's servers.
The signature is not checked.
This splits the token on its dots and decodes the first two parts. It does not verify anything, because verifying needs the signing key and no page should ask you for that. A token that decodes cleanly here is well formed, which is not the same as valid.
The token is read in this page and is not sent anywhere. You can check that in your browser's network tab: pasting one produces no request at all.
Questions
- Is what I paste sent anywhere?
- No. Every tool in this kit runs in the page itself. There is no server here that receives what you paste, and you can check it in your browser's network tab: using a tool produces no request carrying your input at all.
- Does this verify the signature?
- No, and it will not. Verifying needs the signing key, and a page that asked you to paste your signing key into a text box would deserve everything that followed. A token that decodes cleanly here is well formed, which is not the same as valid.
- Is it safe to paste a real token here?
- The token is read in this page and no request carries it, which you can confirm in your network tab. That said, a JWT is a credential: anyone who has it can use it until it expires. Treat pasting one anywhere, here included, the way you would treat pasting a password.
- What do exp, iat and nbf mean?
- Expires at, issued at, and not valid before. All three are counted in seconds since 1970 per the spec, and all three are shown here in your local time as well as raw.
- Why can I read the payload without a key?
- Because a JWT payload is base64, not encryption. It is signed so it cannot be changed without detection, not hidden. Anything secret does not belong in one.
The other tools here
- JSON formatter, format, minify and validate
- Base64 encoder, encode and decode, text or file
- URL encoder, encode and decode, two rules
- UUID generator, version 4, one to a hundred
- Hash generator, sha-256, sha-1 and md5 at once
- Regex tester, live matches, groups and flags
- Text diff, compare two blocks, by line or word
- Timestamp converter, unix time to a date, and back
- Cron explainer, a schedule, in plain english
- Colour converter, hex, rgb, hsl, and a contrast check
- Markdown preview, live preview, and copy the html
- JSON to CSV, an array of objects into a spreadsheet